urlscan.io logo urlscan.io
SecurityTrails logo

www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Submission: On December 05 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 145 IPs in 11 countries across 132 domains to perform 931 HTTP transactions. The main IP is 104.20.60.209, located in and belongs to CLOUDFLARENET, US. The main domain is www.bleepingcomputer.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 16th 2020. Valid for: 2 years.
This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 104.20.60.209 13335 (CLOUDFLAR...)
4 2607:f8b0:400... 15169 (GOOGLE)
32 104.26.13.6 13335 (CLOUDFLAR...)
23 2606:2800:220... 15133 (EDGECAST)
10 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
3 4 2607:f8b0:400... 15169 (GOOGLE)
6 2607:f8b0:400... 15169 (GOOGLE)
39 2607:f8b0:400... 15169 (GOOGLE)
7 23.208.216.126 16625 (AKAMAI-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 18 151.101.130.137 54113 (FASTLY)
1 13.225.63.107 16509 (AMAZON-02)
2 13.225.214.111 16509 (AMAZON-02)
7 2607:f8b0:400... 15169 (GOOGLE)
19 35.201.71.192 15169 (GOOGLE)
6 142.250.81.230 15169 (GOOGLE)
1 23.52.162.190 16625 (AKAMAI-AS)
2 2607:f8b0:400... 15169 (GOOGLE)
23 2607:f8b0:400... 15169 (GOOGLE)
1 4 13.225.214.85 16509 (AMAZON-02)
9 104.126.114.7 16625 (AKAMAI-AS)
1 35.241.45.217 15169 (GOOGLE)
20 2607:f8b0:400... 15169 (GOOGLE)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
4 28 23.52.162.21 16625 (AKAMAI-AS)
19 3.13.244.143 16509 (AMAZON-02)
16 142.250.65.194 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
3 2607:f8b0:400... 15169 (GOOGLE)
5 104.244.42.8 13414 (TWITTER)
1 151.101.194.137 54113 (FASTLY)
4 2607:f8b0:400... 15169 (GOOGLE)
19 28 15.197.193.217 16509 (AMAZON-02)
11 36 68.67.161.183 29990 (ASN-APPNEX)
2 2 23.211.130.59 16625 (AKAMAI-AS)
8 23.73.244.44 16625 (AKAMAI-AS)
6 23.52.161.180 16625 (AKAMAI-AS)
7 21 34.98.64.218 15169 (GOOGLE)
1 1 129.159.70.95 31898 (ORACLE-BM...)
2 151.101.1.140 54113 (FASTLY)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
4 3.142.30.148 16509 (AMAZON-02)
2 35.227.238.208 15169 (GOOGLE)
1 130.211.23.194 15169 (GOOGLE)
7 2607:f8b0:400... 15169 (GOOGLE)
3 2600:9000:21d... 16509 (AMAZON-02)
5 54.192.160.42 16509 (AMAZON-02)
15 54.230.162.118 16509 (AMAZON-02)
2 5 104.36.115.113 62713 (AS-PUBMATIC)
3 5 2620:116:800b... 14618 (AMAZON-AES)
1 13.225.205.179 16509 (AMAZON-02)
1 23.52.162.163 16625 (AKAMAI-AS)
2 2602:803:c002... 26667 (RUBICONPR...)
2 23.199.204.79 16625 (AKAMAI-AS)
19 104.16.190.66 13335 (CLOUDFLAR...)
2 35.211.165.199 19527 (GOOGLE-2)
5 104.36.115.111 62713 (AS-PUBMATIC)
13 3.230.217.116 14618 (AMAZON-AES)
5 35.169.74.7 14618 (AMAZON-AES)
1 34.149.20.76 15169 (GOOGLE)
2 18.215.212.25 14618 (AMAZON-AES)
13 54.146.21.104 14618 (AMAZON-AES)
2 34.107.148.139 15169 (GOOGLE)
9 14 69.173.151.100 26667 (RUBICONPR...)
8 23.52.160.130 16625 (AKAMAI-AS)
2 12 3.223.214.70 14618 (AMAZON-AES)
4 5 185.167.164.39 198622 (ADFORM)
8 8 151.101.194.49 54113 (FASTLY)
2 29 104.36.115.109 62713 (AS-PUBMATIC)
2 4 3.233.68.37 14618 (AMAZON-AES)
22 35 142.250.80.66 15169 (GOOGLE)
3 3 178.250.0.163 44788 (ASN-CRITE...)
2 3 74.119.119.150 19750 (AS-CRITEO)
1 38.91.45.7 398989 (DEEPINTENT)
2 2 173.231.178.82 29791 (VOXEL-DOT...)
4 4 54.209.16.83 14618 (AMAZON-AES)
2 3 2606:4700::68... 13335 (CLOUDFLAR...)
4 4 54.161.144.238 14618 (AMAZON-AES)
1 38.27.122.101 174 (COGENT-174)
3 3 199.127.204.147 26120 (RHYTHMONE)
1 1 69.90.254.78 13768 (COGECO-PEER1)
1 1 104.45.178.220 8075 (MICROSOFT...)
2 2 104.64.223.161 16625 (AKAMAI-AS)
4 12 35.190.60.146 15169 (GOOGLE)
2 2 107.178.254.65 15169 (GOOGLE)
1 1 34.98.67.3 15169 (GOOGLE)
8 8 74.121.140.14 30419 (MEDIAMATH...)
2 8.28.7.84 62713 (AS-PUBMATIC)
3 3 52.116.221.248 36351 (SOFTLAYER)
7 7 2620:112:f002... 6336 (TURN-US-ASN)
7 12 54.175.87.114 14618 (AMAZON-AES)
4 12 2600:1f18:4e9... 14618 (AMAZON-AES)
2 2 2606:ae80:145... 25751 (VALUECLICK)
1 52.202.47.217 14618 (AMAZON-AES)
1 1 34.203.25.60 14618 (AMAZON-AES)
1 2 38.67.14.233 174 (COGENT-174)
3 3 207.198.113.177 13768 (COGECO-PEER1)
19 21 18.195.106.43 16509 (AMAZON-02)
5 5 35.207.24.140 15169 (GOOGLE)
1 1 45.35.192.162 40676 (AS40676)
1 23.5.238.78 16625 (AKAMAI-AS)
1 46.105.202.126 16276 (OVH)
1 2600:9000:21d... 16509 (AMAZON-02)
1 107.21.96.249 14618 (AMAZON-AES)
38 2607:f8b0:400... 15169 (GOOGLE)
6 151.101.2.133 54113 (FASTLY)
2 52.20.92.17 14618 (AMAZON-AES)
1 2 18.209.200.15 14618 (AMAZON-AES)
2 2607:f8b0:400... 15169 (GOOGLE)
4 2001:4998:14:... 14777 (YAHOO)
1 19 209.54.176.128 16509 (AMAZON-02)
3 3.223.207.71 14618 (AMAZON-AES)
1 3 51.195.5.234 16276 (OVH)
12 52.3.145.60 14618 (AMAZON-AES)
4 9 34.233.74.164 14618 (AMAZON-AES)
2 75.101.253.183 14618 (AMAZON-AES)
1 1 199.187.193.179 47043 (SMARTADSE...)
1 1 20.72.149.136 8075 (MICROSOFT...)
8 8 2001:438:65:1... 26762 (CNVR-US-EAST)
1 2 63.251.114.136 12181 (INTERNAP-...)
4 18 35.71.139.29 16509 (AMAZON-02)
2 151.101.66.133 54113 (FASTLY)
2 2606:2800:220... 15133 (EDGECAST)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 2 52.0.156.250 14618 (AMAZON-AES)
4 4 107.178.246.49 15169 (GOOGLE)
1 1 198.148.27.139 19189 (PULSEPOINT)
1 1 192.132.33.46 18568 (BIDTELLECT)
2 104.36.115.114 62713 (AS-PUBMATIC)
2 2 185.184.8.65 204995 (RTB-HOUSE...)
5 63.251.86.49 32475 (SINGLEHOP...)
1 1 213.19.162.90 3356 (LEVEL3)
1 1 34.198.192.195 14618 (AMAZON-AES)
4 104.244.43.131 54113 (FASTLY)
3 18.189.161.24 16509 (AMAZON-02)
8 151.101.248.159 54113 (FASTLY)
18 23.52.163.40 16625 (AKAMAI-AS)
4 3.19.190.206 16509 (AMAZON-02)
5 10 52.4.60.129 14618 (AMAZON-AES)
1 5 199.250.161.129 26459 (TTD-ASN-01)
5 54.230.162.32 16509 (AMAZON-02)
5 151.101.1.108 54113 (FASTLY)
16 68.67.161.206 29990 (ASN-APPNEX)
5 5 35.190.90.30 15169 (GOOGLE)
1 147.135.11.205 16276 (OVH)
12 142.251.41.2 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
11 13.226.37.103 16509 (AMAZON-02)
5 2600:9000:21d... 16509 (AMAZON-02)
15 54.82.161.49 14618 (AMAZON-AES)
8 34.206.47.24 14618 (AMAZON-AES)
1 1 52.5.82.14 14618 (AMAZON-AES)
5 5 104.126.112.185 16625 (AKAMAI-AS)
1 18.207.77.150 14618 (AMAZON-AES)
1 1 64.58.232.176 13649 (ASN-VINS)
1 64.58.232.180 13649 (ASN-VINS)
1 1 2600:1901:0:8... 15169 (GOOGLE)
1 1 184.29.132.233 16625 (AKAMAI-AS)
1 1 35.227.252.103 15169 (GOOGLE)
2 3.134.2.65 16509 (AMAZON-02)
7 7 67.202.105.24 32748 (STEADFAST)
1 2 67.202.105.32 32748 (STEADFAST)
28 23.52.167.93 16625 (AKAMAI-AS)
1 104.17.119.107 13335 (CLOUDFLAR...)
5 5 199.38.167.128 54312 (ROCKETFUEL)
7 7 52.45.80.111 14618 (AMAZON-AES)
4 4 2620:109:c002... 14413 (LINKEDIN)
2 4 104.18.101.194 13335 (CLOUDFLAR...)
2 2 204.62.13.72 46636 (NATCOWEB)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
8 8 64.74.236.127 22075 (AS-OUTBRAIN)
2 2620:100:a001::c 19750 (AS-CRITEO)
1 1 54.86.74.19 14618 (AMAZON-AES)
6 34.117.239.71 15169 (GOOGLE)
1 1 2a04:4e42::300 54113 (FASTLY)
1 151.101.129.44 54113 (FASTLY)
1 1 172.105.203.31 63949 (LINODE-AP...)
1 1 23.88.75.187 24940 (HETZNER-AS)
1 2 3.228.229.208 14618 (AMAZON-AES)
1 195.5.165.20 44968 (IPROM-AS)
1 1 51.210.112.63 16276 (OVH)
1 2 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2 35.201.96.126 15169 (GOOGLE)
1 2 156.154.202.36 19907 (NEUSTAR-AS6)
1 2 54.83.242.41 14618 (AMAZON-AES)
1 1 34.102.253.54 15169 (GOOGLE)
1 1 159.65.197.210 14061 (DIGITALOC...)
1 52.202.147.57 14618 (AMAZON-AES)
2 2 185.184.10.30 203690 (RTB-HOUSE...)
1 51.81.106.33 16276 (OVH)
1 1 54.236.220.178 14618 (AMAZON-AES)
1 2 54.208.142.27 14618 (AMAZON-AES)
1 152.195.32.163 15133 (EDGECAST)
2 52.1.108.21 14618 (AMAZON-AES)
30 13.226.37.126 16509 (AMAZON-02)
1 152.195.14.41 15133 (EDGECAST)
931 145
4    104.20.60.209 (None, )

ASN13335 (CLOUDFLARENET, US)
www.bleepingcomputer.com
4    2607:f8b0:4006:822::200a (United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
32    104.26.13.6 (United States)

ASN13335 (CLOUDFLARENET, US)
www.bleepstatic.com
23    2606:2800:220:de:468:2285:c1:4a3 (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
10    2606:4700:20::681a:18b (United States)

ASN13335 (CLOUDFLARENET, US)
a.pub.network
1    2607:f8b0:4006:822::2008 (United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
4    2607:f8b0:4006:80a::2004 (United States)

ASN15169 (GOOGLE, US)
www.google.com
6    2607:f8b0:4006:80b::2003 (United States)

ASN15169 (GOOGLE, US)
www.gstatic.com
39    2607:f8b0:4006:80f::2002 (United States)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
7    23.208.216.126 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-216-126.deploy.static.akamaitechnologies.com
s9.addthis.com
v1.addthisedge.com
m.addthis.com
s7.addthis.com
api-public.addthis.com
1    2606:4700::6810:5e41 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
18    151.101.130.137 (United States)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
img.connatix.com
cks.connatix.com
ck.connatix.com
1    13.225.63.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-107.ewr53.r.cloudfront.net
ecdn.analysis.fi
2    13.225.214.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-111.ewr50.r.cloudfront.net
ecdn.firstimpression.io
cdn.firstimpression.io
7    2607:f8b0:4006:823::2003 (United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
19    35.201.71.192 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 192.71.201.35.bc.googleusercontent.com
d.pub.network
c.pub.network
6    142.250.81.230 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s74-in-f6.1e100.net
ad.doubleclick.net
1    23.52.162.190 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-162-190.deploy.static.akamaitechnologies.com
widgets.outbrain.com
2    2607:f8b0:4006:807::200e (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
23    2607:f8b0:4006:81e::2002 (United States)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
adservice.google.ca
4    13.225.214.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-85.ewr50.r.cloudfront.net
sb.scorecardresearch.com
9    104.126.114.7 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-126-114-7.deploy.static.akamaitechnologies.com
z.moatads.com
1    35.241.45.217 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 217.45.241.35.bc.googleusercontent.com
pghub.io
20    2607:f8b0:4006:823::2002 (United States)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    2606:4700:3039::6815:c077 (United States)

ASN13335 (CLOUDFLARENET, US)
freestar-io.videoplayerhub.com
1    2606:4700:20::681a:78b (United States)

ASN13335 (CLOUDFLARENET, US)
btloader.com
28    23.52.162.21 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-162-21.deploy.static.akamaitechnologies.com
js-sec.indexww.com
ssum.casalemedia.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
19    3.13.244.143 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-13-244-143.us-east-2.compute.amazonaws.com
capi.connatix.com
16    142.250.65.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f2.1e100.net
partner.googleadservices.com
securepubads.g.doubleclick.net
1    2607:f8b0:4006:807::2002 (United States)

ASN15169 (GOOGLE, US)
adservice.google.ca
3    2607:f8b0:4006:80b::2002 (United States)

ASN15169 (GOOGLE, US)
adservice.google.com
5    104.244.42.8 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
1    151.101.194.137 (United States)

ASN54113 (FASTLY, US)
vid.connatix.com
4    2607:f8b0:4006:81e::200a (United States)

ASN15169 (GOOGLE, US)
imasdk.googleapis.com
28    15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
insight.adsrvr.org
36    68.67.161.183 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com
ib.adnxs.com
2    23.211.130.59 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-211-130-59.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
8    23.73.244.44 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-73-244-44.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
6    23.52.161.180 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-161-180.deploy.static.akamaitechnologies.com
ads.pubmatic.com
21    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
us-u.openx.net
freestar-d.openx.net
1    129.159.70.95 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
2    151.101.1.140 (United States)

ASN54113 (FASTLY, US)
www.reddit.com
1    2606:4700:20::ac43:4513 (United States)

ASN13335 (CLOUDFLARENET, US)
ad-delivery.net
4    3.142.30.148 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-142-30-148.us-east-2.compute.amazonaws.com
vid.springserve.com
2    35.227.238.208 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 208.238.227.35.bc.googleusercontent.com
api.floors.dev
1    130.211.23.194 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 194.23.211.130.bc.googleusercontent.com
api.btloader.com
7    2607:f8b0:4006:80a::2006 (United States)

ASN15169 (GOOGLE, US)
s0.2mdn.net
3    2600:9000:21dd:9400:15:6f6c:b180:93a1 (United States)

ASN16509 (AMAZON-02, US)
vpaid.springserve.com
5    54.192.160.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-160-42.ewr53.r.cloudfront.net
c.amazon-adsystem.com
15    54.230.162.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-162-118.ewr53.r.cloudfront.net
tagan.adlightning.com
5    104.36.115.113 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
5    2620:116:800b:21:61c0:eb61:c438:2f4e (United States)

ASN14618 (AMAZON-AES, US)
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
1    13.225.205.179 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-205-179.ewr50.r.cloudfront.net
dggaenaawxe8z.cloudfront.net
1    23.52.162.163 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-162-163.deploy.static.akamaitechnologies.com
s.ntv.io
2    2602:803:c002:200::62 (United States)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
2    23.199.204.79 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-199-204-79.deploy.static.akamaitechnologies.com
htlb.casalemedia.com
19    104.16.190.66 (None, )

ASN13335 (CLOUDFLARENET, US)
dmx.districtm.io
cdn.districtm.io
2    35.211.165.199 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 199.165.211.35.bc.googleusercontent.com
grid.bidswitch.net
5    104.36.115.111 (United States)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
13    3.230.217.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-230-217-116.compute-1.amazonaws.com
c2shb.ssp.yahoo.com
5    35.169.74.7 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-169-74-7.compute-1.amazonaws.com
ads.yieldmo.com
1    34.149.20.76 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 76.20.149.34.bc.googleusercontent.com
ssc.33across.com
2    18.215.212.25 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-215-212-25.compute-1.amazonaws.com
tlx.3lift.com
13    54.146.21.104 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-21-104.compute-1.amazonaws.com
btlr.sharethrough.com
2    34.107.148.139 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 139.148.107.34.bc.googleusercontent.com
prebid.media.net
14    69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
8    23.52.160.130 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-160-130.deploy.static.akamaitechnologies.com
acdn.adnxs.com
12    3.223.214.70 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-214-70.compute-1.amazonaws.com
ads.adaptv.advertising.com
5    185.167.164.39 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
8    151.101.194.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
29    104.36.115.109 (United States)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
image2.pubmatic.com
4    3.233.68.37 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-233-68-37.compute-1.amazonaws.com
match.prod.bidr.io
35    142.250.80.66 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f2.1e100.net
cm.g.doubleclick.net
3    178.250.0.163 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
3    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
widget.us.criteo.com
1    38.91.45.7 (United States)

ASN398989 (DEEPINTENT, US)
match.deepintent.com
2    173.231.178.82 (United States)

ASN29791 (VOXEL-DOT-NET, US)
cm.adgrx.com
4    54.209.16.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-209-16-83.compute-1.amazonaws.com
sync.srv.stackadapt.com
3    2606:4700::6812:c05 (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
4    54.161.144.238 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-161-144-238.compute-1.amazonaws.com
pm.w55c.net
1    38.27.122.101 (United States)

ASN174 (COGENT-174, US)
match.bnmla.com
3    199.127.204.147 (United States)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
1    69.90.254.78 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
ums.acuityplatform.com
1    104.45.178.220 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
mweb.ck.inmobi.com
2    104.64.223.161 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-64-223-161.deploy.static.akamaitechnologies.com
px.owneriq.net
12    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com
id.rlcdn.com
2    107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
1    34.98.67.3 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
8    74.121.140.14 (Reston, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
2    8.28.7.84 (United States)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
3    52.116.221.248 (United States)

ASN36351 (SOFTLAYER, US)
PTR: f8.dd.7434.ip4.static.sl-reverse.com
um.simpli.fi
7    2620:112:f002:bbbb::21 (United States)

ASN6336 (TURN-US-ASN, US)
ad.turn.com
12    54.175.87.114 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-87-114.compute-1.amazonaws.com
ups.analytics.yahoo.com
12    2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
pr-bh.ybp.yahoo.com
2    2606:ae80:1451:13::2360 (United States)

ASN25751 (VALUECLICK, US)
pubmatic-match.dotomi.com
1    52.202.47.217 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-47-217.compute-1.amazonaws.com
rtb.adentifi.com
1    34.203.25.60 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-203-25-60.compute-1.amazonaws.com
sync.ipredictive.com
2    38.67.14.233 (United States)

ASN174 (COGENT-174, US)
pmp.mxptint.net
3    207.198.113.177 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
21    18.195.106.43 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-106-43.eu-central-1.compute.amazonaws.com
x.bidswitch.net
5    35.207.24.140 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com
rtb.mfadsrvr.com
1    45.35.192.162 (United States)

ASN40676 (AS40676, US)
sync.resetdigital.co
1    23.5.238.78 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-5-238-78.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net
1    46.105.202.126 (France)

ASN16276 (OVH, FR)
cdn.id5-sync.com
1    2600:9000:21dd:9a00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
1    107.21.96.249 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-21-96-249.compute-1.amazonaws.com
hb.emxdgt.com
38    2607:f8b0:4006:80b::2001 (United States)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
6    151.101.2.133 (United States)

ASN54113 (FASTLY, US)
cdn.krxd.net
2    52.20.92.17 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-92-17.compute-1.amazonaws.com
uat5-a.investingchannel.com
2    18.209.200.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-209-200-15.compute-1.amazonaws.com
jadserve.postrelease.com
2    2607:f8b0:4006:80c::2001 (United States)

ASN15169 (GOOGLE, US)
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
4    2001:4998:14:800::1001 (Ashburn, United States)

ASN14777 (YAHOO, US)
ads.yahoo.com
cdn-ssl.vidible.tv
19    209.54.176.128 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
3    3.223.207.71 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-207-71.compute-1.amazonaws.com
acds.prod.vidible.tv
3    51.195.5.234 (France)

ASN16276 (OVH, FR)
PTR: p36.id5-sync.com
id5-sync.com
12    52.3.145.60 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-145-60.compute-1.amazonaws.com
trk.vidible.tv
9    34.233.74.164 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-233-74-164.compute-1.amazonaws.com
match.sharethrough.com
2    75.101.253.183 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-75-101-253-183.compute-1.amazonaws.com
sync-amz.ads.yieldmo.com
sync-pp.ads.yieldmo.com
1    199.187.193.179 (Canada)

ASN47043 (SMARTADSERVER, CA)
ssbsync-us.smartadserver.com
1    20.72.149.136 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
sync.inmobi.com
8    2001:438:65:11::1720 (United States)

ASN26762 (CNVR-US-EAST, US)
amazon-tam-match.dotomi.com
medianet-match.dotomi.com
33across-match.dotomi.com
2    63.251.114.136 (United States)

ASN12181 (INTERNAP-2BLK, US)
ap.lijit.com
18    35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
2    151.101.66.133 (United States)

ASN54113 (FASTLY, US)
consumer.krxd.net
2    2606:2800:220:1410:489:141e:20bb:12f6 (United States)

ASN15133 (EDGECAST, US)
cdn.syndication.twimg.com
1    2606:4700:20::681a:ad1 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
2    52.0.156.250 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-156-250.compute-1.amazonaws.com
loadm.exelator.com
4    107.178.246.49 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 49.246.178.107.bc.googleusercontent.com
pixel.tapad.com
1    198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
1    192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com
bttrack.com
2    104.36.115.114 (United States)

ASN62713 (AS-PUBMATIC, US)
simage4.pubmatic.com
2    185.184.8.65 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net
creativecdn.com
5    63.251.86.49 (United States)

ASN32475 (SINGLEHOP-LLC, US)
ce.lijit.com
1    213.19.162.90 (United Kingdom)

ASN3356 (LEVEL3, US)
pixel-eu.rubiconproject.com
1    34.198.192.195 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-198-192-195.compute-1.amazonaws.com
aorta.clickagy.com
4    104.244.43.131 (United States)

ASN54113 (FASTLY, US)
abs-0.twimg.com
3    18.189.161.24 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-189-161-24.us-east-2.compute.amazonaws.com
bc-ssb-cle.springserve.com
8    151.101.248.159 (Ashburn, United States)

ASN54113 (FASTLY, US)
pbs.twimg.com
18    23.52.163.40 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-163-40.deploy.static.akamaitechnologies.com
px.moatads.com
4    3.19.190.206 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-19-190-206.us-east-2.compute.amazonaws.com
vid-io-cle.springserve.com
10    52.4.60.129 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-60-129.compute-1.amazonaws.com
fw.adsafeprotected.com
5    199.250.161.129 (United States)

ASN26459 (TTD-ASN-01, US)
ny1-bid.adsrvr.org
5    54.230.162.32 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-162-32.ewr53.r.cloudfront.net
choices.truste.com
5    151.101.1.108 (United States)

ASN54113 (FASTLY, US)
cdn.adnxs.com
16    68.67.161.206 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
nym1-ib.adnxs.com
5    35.190.90.30 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com
odr.mookie1.com
1    147.135.11.205 (United States)

ASN16276 (OVH, FR)
PTR: us004.roqad.pl
ws.rqtrk.eu
12    142.251.41.2 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f2.1e100.net
googleads4.g.doubleclick.net
2    2607:f8b0:4006:80a::2010 (United States)

ASN15169 (GOOGLE, US)
storage.googleapis.com
11    13.226.37.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-37-103.ewr53.r.cloudfront.net
freestar-tagan.adlightning.com
5    2600:9000:21dd:be00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
static.adsafeprotected.com
15    54.82.161.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-161-49.compute-1.amazonaws.com
dt.adsafeprotected.com
8    34.206.47.24 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-47-24.compute-1.amazonaws.com
beacon.krxd.net
1    52.5.82.14 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-82-14.compute-1.amazonaws.com
usermatch.krxd.net
5    104.126.112.185 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-126-112-185.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    18.207.77.150 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-207-77-150.compute-1.amazonaws.com
ps.eyeota.net
1    64.58.232.176 (United States)

ASN13649 (ASN-VINS, US)
global.ib-ibi.com
1    64.58.232.180 (United States)

ASN13649 (ASN-VINS, US)
ib.mookie1.com
1    2600:1901:0:8eee:: (Kansas City, United States)

ASN15169 (GOOGLE, US)
fei.pro-market.net
1    184.29.132.233 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-132-233.deploy.static.akamaitechnologies.com
e.dlx.addthis.com
1    35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com
rtb.openx.net
2    3.134.2.65 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-134-2-65.us-east-2.compute.amazonaws.com
geo.moatads.com
mb.moatads.com
7    67.202.105.24 (United States)

ASN32748 (STEADFAST, US)
PTR: ip24.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
2    67.202.105.32 (United States)

ASN32748 (STEADFAST, US)
PTR: ip32.67-202-105.static.steadfastdns.net
de.tynt.com
28    23.52.167.93 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-167-93.deploy.static.akamaitechnologies.com
contextual.media.net
hbx.media.net
cs.media.net
c21lg-d.media.net
1    104.17.119.107 (None, )

ASN13335 (CLOUDFLARENET, US)
biddr.brealtime.com
5    199.38.167.128 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
7    52.45.80.111 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-80-111.compute-1.amazonaws.com
pixel.advertising.com
4    2620:109:c002::6cae:a0e (United States)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
4    104.18.101.194 (None, )

ASN13335 (CLOUDFLARENET, US)
p.adsymptotic.com
2    204.62.13.72 (Clifton, United States)

ASN46636 (NATCOWEB, US)
inv-nets.admixer.net
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
8    64.74.236.127 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: chi.outbrain.com
b1sync.zemanta.com
2    2620:100:a001::c (United States)

ASN19750 (AS-CRITEO, US)
gum.criteo.com
1    54.86.74.19 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-74-19.compute-1.amazonaws.com
cms-xch.33across.com
6    34.117.239.71 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 71.239.117.34.bc.googleusercontent.com
cms-xch-chicago.33across.com
1    2a04:4e42::300 (United States)

ASN54113 (FASTLY, US)
trc.taboola.com
1    151.101.129.44 (United States)

ASN54113 (FASTLY, US)
match.taboola.com
1    172.105.203.31 (Tokyo, Japan)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1857-31.members.linode.com
gocm.c.appier.net
1    23.88.75.187 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.187.75.88.23.clients.your-server.de
csync.loopme.me
2    3.228.229.208 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-228-229-208.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
1    195.5.165.20 (Slovenia)

ASN44968 (IPROM-AS, SI)
core.iprom.net
1    51.210.112.63 (France)

ASN16276 (OVH, FR)
PTR: pikafka-3.cloudy.ovh
pixel.onaudience.com
2    2606:4700:10::6816:1857 (United States)

ASN13335 (CLOUDFLARENET, US)
spl.zeotap.com
mwzeom.zeotap.com
2    35.201.96.126 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 126.96.201.35.bc.googleusercontent.com
visitor.fiftyt.com
2    156.154.202.36 (United States)

ASN19907 (NEUSTAR-AS6, US)
aa.agkn.com
2    54.83.242.41 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-83-242-41.compute-1.amazonaws.com
io.narrative.io
1    34.102.253.54 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 54.253.102.34.bc.googleusercontent.com
ads.playground.xyz
1    159.65.197.210 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
match.adsby.bidtheatre.com
1    52.202.147.57 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-147-57.compute-1.amazonaws.com
rtb.gumgum.com
2    185.184.10.30 (Poland)

ASN203690 (RTB-HOUSE-ASH, PL)
PTR: ip-185-184-10-30.rtbhouse.net
us.creativecdn.com
1    51.81.106.33 (New York, United States)

ASN16276 (OVH, FR)
PTR: ns106714.ip-51-81-106.us
gu.dyntrk.com
1    54.236.220.178 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-220-178.compute-1.amazonaws.com
sync.extend.tv
2    54.208.142.27 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-142-27.compute-1.amazonaws.com
um2.eqads.com
1    152.195.32.163 (United States)

ASN15133 (EDGECAST, US)
tag.sp.advertising.com
2    52.1.108.21 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-1-108-21.compute-1.amazonaws.com
ads-ec.v.ssp.yahoo.com
30    13.226.37.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-37-126.ewr53.r.cloudfront.net
choices.trustarc.com
1    152.195.14.41 (United States)

ASN15133 (EDGECAST, US)
tag.idsync.analytics.yahoo.com
Apex Domain
Subdomains		 Transfer
89 doubleclick.net
ad.doubleclick.net
googleads.g.doubleclick.net
securepubads.g.doubleclick.net
cm.g.doubleclick.net
googleads4.g.doubleclick.net
404 KB
79 googlesyndication.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
921 KB
65 adnxs.com
secure.adnxs.com
ib.adnxs.com
acdn.adnxs.com
cdn.adnxs.com
nym1-ib.adnxs.com
345 KB
49 pubmatic.com
ads.pubmatic.com
image6.pubmatic.com
hbopenbid.pubmatic.com
simage2.pubmatic.com
image2.pubmatic.com
image4.pubmatic.com
simage4.pubmatic.com
117 KB
41 yahoo.com
c2shb.ssp.yahoo.com
ups.analytics.yahoo.com
pr-bh.ybp.yahoo.com
ads.yahoo.com
ads-ec.v.ssp.yahoo.com
tag.idsync.analytics.yahoo.com
19 KB
38 connatix.com
cd.connatix.com
cds.connatix.com
capi.connatix.com
vid.connatix.com
img.connatix.com
cks.connatix.com
ck.connatix.com
614 KB
33 adsrvr.org
match.adsrvr.org
ny1-bid.adsrvr.org
insight.adsrvr.org
23 KB
32 bleepstatic.com
www.bleepstatic.com
621 KB
30 trustarc.com
choices.trustarc.com
85 KB
30 adsafeprotected.com
fw.adsafeprotected.com
static.adsafeprotected.com
dt.adsafeprotected.com
483 KB
30 media.net
prebid.media.net
contextual.media.net
hbx.media.net
cs.media.net
c21lg-d.media.net
87 KB
29 moatads.com
z.moatads.com
px.moatads.com
geo.moatads.com
mb.moatads.com
690 KB
29 pub.network
a.pub.network
d.pub.network
c.pub.network
391 KB
28 twitter.com
platform.twitter.com
syndication.twitter.com
744 KB
27 rubiconproject.com
secure-assets.rubiconproject.com
eus.rubiconproject.com
fastlane.rubiconproject.com
token.rubiconproject.com
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
pixel-eu.rubiconproject.com
54 KB
26 adlightning.com
tagan.adlightning.com
freestar-tagan.adlightning.com
376 KB
25 casalemedia.com
ssum.casalemedia.com
htlb.casalemedia.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
36 KB
24 amazon-adsystem.com
c.amazon-adsystem.com
s.amazon-adsystem.com
55 KB
23 bidswitch.net
grid.bidswitch.net
x.bidswitch.net
10 KB
22 sharethrough.com
btlr.sharethrough.com
match.sharethrough.com
5 KB
22 openx.net
us-u.openx.net
freestar-d.openx.net
rtb.openx.net
4 KB
20 advertising.com
ads.adaptv.advertising.com
pixel.advertising.com
tag.sp.advertising.com
11 KB
20 3lift.com
tlx.3lift.com
eb2.3lift.com
15 KB
20 googletagservices.com
www.googletagservices.com
461 KB
19 districtm.io
dmx.districtm.io
cdn.districtm.io
8 KB
18 vidible.tv
acds.prod.vidible.tv
cdn-ssl.vidible.tv
trk.vidible.tv
331 KB
17 krxd.net
cdn.krxd.net
consumer.krxd.net
beacon.krxd.net
usermatch.krxd.net
179 KB
15 33across.com
ssc.33across.com
ssc-cms.33across.com
cms-xch.33across.com
cms-xch-chicago.33across.com
5 KB
14 twimg.com
cdn.syndication.twimg.com
abs-0.twimg.com
pbs.twimg.com
194 KB
14 springserve.com
vid.springserve.com
vpaid.springserve.com
bc-ssb-cle.springserve.com
vid-io-cle.springserve.com
267 KB
13 gstatic.com
www.gstatic.com
fonts.gstatic.com
138 KB
12 rlcdn.com
idsync.rlcdn.com
id.rlcdn.com
1 KB
10 dotomi.com
pubmatic-match.dotomi.com
amazon-tam-match.dotomi.com
medianet-match.dotomi.com
33across-match.dotomi.com
4 KB
10 googleapis.com
fonts.googleapis.com
imasdk.googleapis.com
storage.googleapis.com
713 KB
8 zemanta.com
b1sync.zemanta.com
5 KB
8 mathtag.com
sync.mathtag.com
5 KB
8 criteo.com
dis.criteo.com
widget.us.criteo.com
gum.criteo.com
3 KB
8 everesttech.net
sync-tm.everesttech.net
1 KB
7 lijit.com
ap.lijit.com
ce.lijit.com
7 KB
7 turn.com
ad.turn.com
3 KB
7 yieldmo.com
ads.yieldmo.com
sync-amz.ads.yieldmo.com
sync-pp.ads.yieldmo.com
3 KB
7 2mdn.net
s0.2mdn.net
288 KB
7 addthis.com
s9.addthis.com
m.addthis.com
s7.addthis.com Failed
api-public.addthis.com
e.dlx.addthis.com
219 KB
7 google.com
www.google.com
adservice.google.com
2 KB
6 mookie1.com
odr.mookie1.com
ib.mookie1.com
4 KB
5 rfihub.com
p.rfihub.com
4 KB
5 bluekai.com
stags.bluekai.com
5 KB
5 truste.com
choices.truste.com
47 KB
5 mfadsrvr.com
rtb.mfadsrvr.com
1 KB
5 adform.net
c1.adform.net
2 KB
5 quantserve.com
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
11 KB
5 indexww.com
js-sec.indexww.com
4 KB
4 adsymptotic.com
p.adsymptotic.com
925 B
4 linkedin.com
px.ads.linkedin.com
1 KB
4 creativecdn.com
creativecdn.com
us.creativecdn.com
1 KB
4 tapad.com
pixel.tapad.com
2 KB
4 id5-sync.com
cdn.id5-sync.com
id5-sync.com
13 KB
4 w55c.net
pm.w55c.net
3 KB
4 stackadapt.com
sync.srv.stackadapt.com
1 KB
4 bidr.io
match.prod.bidr.io
2 KB
4 scorecardresearch.com
sb.scorecardresearch.com
2 KB
4 bleepingcomputer.com
www.bleepingcomputer.com
17 KB
3 sitescout.com
pixel-sync.sitescout.com
2 KB
3 simpli.fi
um.simpli.fi
1 KB
3 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
2 KB
3 google.ca
adservice.google.ca
1 KB
2 eqads.com
um2.eqads.com
563 B
2 narrative.io
io.narrative.io
643 B
2 agkn.com
aa.agkn.com
1 KB
2 fiftyt.com
visitor.fiftyt.com
1011 B
2 zeotap.com
spl.zeotap.com
mwzeom.zeotap.com
918 B
2 cognitivlabs.com
beacon.lynx.cognitivlabs.com
573 B
2 taboola.com
trc.taboola.com
match.taboola.com
656 B
2 bing.com
c.bing.com
930 B
2 admixer.net
inv-nets.admixer.net
1 KB
2 tynt.com
de.tynt.com
3 KB
2 exelator.com
loadm.exelator.com
2 KB
2 postrelease.com
jadserve.postrelease.com
1 KB
2 investingchannel.com
uat5-a.investingchannel.com
455 B
2 mxptint.net
pmp.mxptint.net
967 B
2 pippio.com
pippio.com
850 B
2 owneriq.net
px.owneriq.net
1 KB
2 inmobi.com
mweb.ck.inmobi.com
sync.inmobi.com
1 KB
2 1rx.io
sync.1rx.io
1 KB
2 adgrx.com
cm.adgrx.com
1 KB
2 floors.dev
api.floors.dev
4 KB
2 reddit.com
www.reddit.com
3 KB
2 btloader.com
btloader.com
api.btloader.com
24 KB
2 google-analytics.com
www.google-analytics.com
20 KB
2 firstimpression.io
ecdn.firstimpression.io
cdn.firstimpression.io
100 KB
1 extend.tv
sync.extend.tv
546 B
1 dyntrk.com
gu.dyntrk.com
215 B
1 gumgum.com
rtb.gumgum.com
238 B
1 bidtheatre.com
match.adsby.bidtheatre.com
534 B
1 playground.xyz
ads.playground.xyz
464 B
1 onaudience.com
pixel.onaudience.com
398 B
1 iprom.net
core.iprom.net
281 B
1 loopme.me
csync.loopme.me
217 B
1 appier.net
gocm.c.appier.net
395 B
1 brealtime.com
biddr.brealtime.com
1 KB
1 pro-market.net
fei.pro-market.net
324 B
1 ib-ibi.com
global.ib-ibi.com
489 B
1 eyeota.net
ps.eyeota.net
344 B
1 rqtrk.eu
ws.rqtrk.eu
356 B
1 clickagy.com
aorta.clickagy.com
657 B
1 bttrack.com
bttrack.com
695 B
1 contextweb.com
bh.contextweb.com
672 B
1 ad4m.at
ad4m.at
1 smartadserver.com
ssbsync-us.smartadserver.com
329 B
1 emxdgt.com
hb.emxdgt.com
165 B
1 quantcount.com
rules.quantcount.com
1 KB
1 fastclick.net
secure.cdn.fastclick.net
17 KB
1 resetdigital.co
sync.resetdigital.co
485 B
1 ipredictive.com
sync.ipredictive.com
522 B
1 adentifi.com
rtb.adentifi.com
88 B
1 linksynergy.com
tags.rd.linksynergy.com
359 B
1 acuityplatform.com
ums.acuityplatform.com
674 B
1 unrulymedia.com
sync.targeting.unrulymedia.com
650 B
1 bnmla.com
match.bnmla.com
114 B
1 deepintent.com
match.deepintent.com
221 B
1 ntv.io
s.ntv.io
114 KB
1 cloudfront.net
dggaenaawxe8z.cloudfront.net
3 KB
1 ad-delivery.net
ad-delivery.net
940 B
1 technoratimedia.com
sync.technoratimedia.com
741 B
1 googleadservices.com
partner.googleadservices.com
654 B
1 videoplayerhub.com
freestar-io.videoplayerhub.com
532 B
1 pghub.io
pghub.io
4 KB
1 addthisedge.com
v1.addthisedge.com
855 B
1 outbrain.com
widgets.outbrain.com
3 KB
1 analysis.fi
ecdn.analysis.fi
2 KB
1 cloudflareinsights.com
static.cloudflareinsights.com
5 KB
1 googletagmanager.com
www.googletagmanager.com
36 KB
931 132
Domain Requested by
39 pagead2.googlesyndication.com www.bleepingcomputer.com
pagead2.googlesyndication.com
srcdoc
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
www.googletagservices.com
tagan.adlightning.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
38 tpc.googlesyndication.com googleads.g.doubleclick.net
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
tagan.adlightning.com
35 cm.g.doubleclick.net 22 redirects eus.rubiconproject.com
googleads.g.doubleclick.net
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
www.bleepingcomputer.com
eb2.3lift.com
us-u.openx.net
32 www.bleepstatic.com www.bleepingcomputer.com
www.bleepstatic.com
31 ib.adnxs.com 6 redirects a.pub.network
vpaid.springserve.com
acdn.adnxs.com
sync-amz.ads.yieldmo.com
googleads.g.doubleclick.net
30 choices.trustarc.com tagan.adlightning.com
www.bleepingcomputer.com
23 platform.twitter.com www.bleepingcomputer.com
platform.twitter.com
21 x.bidswitch.net 19 redirects www.bleepingcomputer.com
21 simage2.pubmatic.com 2 redirects ads.pubmatic.com
21 googleads.g.doubleclick.net pagead2.googlesyndication.com
googleads.g.doubleclick.net
tagan.adlightning.com
www.bleepingcomputer.com
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
www.googletagservices.com
20 contextual.media.net a.pub.network
contextual.media.net
20 www.googletagservices.com a.pub.network
googleads.g.doubleclick.net
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
tagan.adlightning.com
www.bleepingcomputer.com
19 s.amazon-adsystem.com 1 redirects tagan.adlightning.com
s.amazon-adsystem.com
ssum-sec.casalemedia.com
sync-amz.ads.yieldmo.com
match.sharethrough.com
ap.lijit.com
eus.rubiconproject.com
eb2.3lift.com
us-u.openx.net
19 us-u.openx.net 7 redirects a.pub.network
us-u.openx.net
19 match.adsrvr.org 19 redirects
19 capi.connatix.com cd.connatix.com
www.bleepingcomputer.com
ads.pubmatic.com
eus.rubiconproject.com
18 px.moatads.com www.bleepingcomputer.com
18 eb2.3lift.com 4 redirects a.pub.network
eb2.3lift.com
17 dsum-sec.casalemedia.com 2 redirects ssum-sec.casalemedia.com
googleads.g.doubleclick.net
um2.eqads.com
16 nym1-ib.adnxs.com tagan.adlightning.com
cdn.adnxs.com
15 dt.adsafeprotected.com www.bleepingcomputer.com
15 dmx.districtm.io a.pub.network
cdn.districtm.io
www.bleepingcomputer.com
15 tagan.adlightning.com a.pub.network
tagan.adlightning.com
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
15 securepubads.g.doubleclick.net www.googletagservices.com
cd.connatix.com
securepubads.g.doubleclick.net
www.bleepingcomputer.com
13 btlr.sharethrough.com a.pub.network
13 c2shb.ssp.yahoo.com a.pub.network
12 googleads4.g.doubleclick.net googleads.g.doubleclick.net
ad.doubleclick.net
12 trk.vidible.tv www.bleepingcomputer.com
12 pr-bh.ybp.yahoo.com 4 redirects ads.pubmatic.com
ssum-sec.casalemedia.com
us-u.openx.net
12 ups.analytics.yahoo.com 7 redirects www.bleepingcomputer.com
us-u.openx.net
12 ads.adaptv.advertising.com 2 redirects vpaid.springserve.com
cdn-ssl.vidible.tv
11 freestar-tagan.adlightning.com tagan.adlightning.com
11 d.pub.network a.pub.network
10 fw.adsafeprotected.com 5 redirects tagan.adlightning.com
10 img.connatix.com www.bleepingcomputer.com
10 a.pub.network www.bleepingcomputer.com
a.pub.network
tagan.adlightning.com
9 insight.adsrvr.org www.bleepingcomputer.com
9 match.sharethrough.com 4 redirects s.amazon-adsystem.com
match.sharethrough.com
9 z.moatads.com s9.addthis.com
cdn-ssl.vidible.tv
tagan.adlightning.com
8 b1sync.zemanta.com 8 redirects
8 beacon.krxd.net cdn.krxd.net
www.bleepingcomputer.com
8 pbs.twimg.com www.bleepingcomputer.com
platform.twitter.com
8 c.pub.network a.pub.network
8 sync.mathtag.com 8 redirects
8 image2.pubmatic.com ads.pubmatic.com
8 sync-tm.everesttech.net 8 redirects
8 acdn.adnxs.com vpaid.springserve.com
www.bleepingcomputer.com
a.pub.network
8 eus.rubiconproject.com cd.connatix.com
eus.rubiconproject.com
s.amazon-adsystem.com
a.pub.network
de.tynt.com
7 pixel.advertising.com 7 redirects
7 ssc-cms.33across.com 7 redirects
7 ad.turn.com 7 redirects
7 idsync.rlcdn.com 2 redirects ads.pubmatic.com
www.bleepingcomputer.com
us-u.openx.net
7 s0.2mdn.net imasdk.googleapis.com
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
www.bleepingcomputer.com
tagan.adlightning.com
7 fonts.gstatic.com fonts.googleapis.com
6 cms-xch-chicago.33across.com de.tynt.com
eus.rubiconproject.com
6 cdn.krxd.net www.bleepingcomputer.com
cdn.krxd.net
tagan.adlightning.com
6 ads.pubmatic.com cd.connatix.com
ads.pubmatic.com
s.amazon-adsystem.com
a.pub.network
6 ad.doubleclick.net www.bleepingcomputer.com
tagan.adlightning.com
6 www.gstatic.com www.bleepingcomputer.com
googleads.g.doubleclick.net
5 p.rfihub.com 5 redirects
5 stags.bluekai.com 5 redirects
5 static.adsafeprotected.com tagan.adlightning.com
5 odr.mookie1.com 5 redirects
5 cdn.adnxs.com tagan.adlightning.com
5 choices.truste.com tagan.adlightning.com
5 ny1-bid.adsrvr.org 1 redirects tagan.adlightning.com
5 ce.lijit.com ap.lijit.com
5 id.rlcdn.com 2 redirects eus.rubiconproject.com
contextual.media.net
5 pixel.rubiconproject.com 1 redirects eus.rubiconproject.com
5 rtb.mfadsrvr.com 5 redirects
5 c1.adform.net 4 redirects ads.pubmatic.com
5 token.rubiconproject.com 4 redirects eus.rubiconproject.com
5 ads.yieldmo.com a.pub.network
sync-amz.ads.yieldmo.com
5 hbopenbid.pubmatic.com a.pub.network
vpaid.springserve.com
5 image6.pubmatic.com 2 redirects ads.pubmatic.com
5 c.amazon-adsystem.com a.pub.network
c.amazon-adsystem.com
5 secure.adnxs.com 5 redirects
5 syndication.twitter.com platform.twitter.com
www.bleepingcomputer.com
5 js-sec.indexww.com a.pub.network
ssum-sec.casalemedia.com
4 cs.media.net contextual.media.net
4 medianet-match.dotomi.com 4 redirects
4 p.adsymptotic.com 2 redirects eb2.3lift.com
4 px.ads.linkedin.com 4 redirects
4 cdn.districtm.io a.pub.network
cdn.districtm.io
4 vid-io-cle.springserve.com vpaid.springserve.com
4 abs-0.twimg.com www.bleepingcomputer.com
4 pixel.tapad.com 4 redirects
4 ssum-sec.casalemedia.com s.amazon-adsystem.com
ssum-sec.casalemedia.com
js-sec.indexww.com
4 pixel-us-east.rubiconproject.com 4 redirects
4 pm.w55c.net 4 redirects
4 sync.srv.stackadapt.com 4 redirects
4 match.prod.bidr.io 2 redirects ads.pubmatic.com
ssum-sec.casalemedia.com
4 vid.springserve.com cd.connatix.com
vpaid.springserve.com
4 cks.connatix.com 1 redirects www.bleepingcomputer.com
4 imasdk.googleapis.com cd.connatix.com
imasdk.googleapis.com
4 sb.scorecardresearch.com 1 redirects a.pub.network
www.bleepingcomputer.com
4 www.google.com 3 redirects tagan.adlightning.com
4 fonts.googleapis.com www.bleepingcomputer.com
googleads.g.doubleclick.net
4 www.bleepingcomputer.com static.cloudflareinsights.com
3 bc-ssb-cle.springserve.com vpaid.springserve.com
3 cdn-ssl.vidible.tv acds.prod.vidible.tv
3 id5-sync.com 1 redirects cdn.id5-sync.com
www.bleepingcomputer.com
3 acds.prod.vidible.tv www.bleepingcomputer.com
3 pixel.quantserve.com 2 redirects www.bleepingcomputer.com
3 pixel-sync.sitescout.com 3 redirects
3 um.simpli.fi 3 redirects
3 widget.us.criteo.com 2 redirects ads.pubmatic.com
3 dis.criteo.com 3 redirects
3 vpaid.springserve.com cd.connatix.com
3 adservice.google.com pagead2.googlesyndication.com
tagan.adlightning.com
3 adservice.google.ca pagead2.googlesyndication.com
tagan.adlightning.com
3 s7.addthis.com s9.addthis.com
2 ads-ec.v.ssp.yahoo.com www.bleepingcomputer.com
2 um2.eqads.com 1 redirects ssum-sec.casalemedia.com
2 c21lg-d.media.net contextual.media.net
2 us.creativecdn.com 2 redirects
2 io.narrative.io 1 redirects ads.pubmatic.com
2 aa.agkn.com 1 redirects ads.pubmatic.com
2 visitor.fiftyt.com 1 redirects ads.pubmatic.com
2 beacon.lynx.cognitivlabs.com 1 redirects ads.pubmatic.com
2 33across-match.dotomi.com 2 redirects
2 gum.criteo.com contextual.media.net
2 hbx.media.net contextual.media.net
2 c.bing.com eb2.3lift.com
2 inv-nets.admixer.net 2 redirects
2 de.tynt.com 1 redirects a.pub.network
2 storage.googleapis.com tagan.adlightning.com
2 creativecdn.com 2 redirects
2 simage4.pubmatic.com ads.pubmatic.com
2 loadm.exelator.com 2 redirects
2 cdn.syndication.twimg.com platform.twitter.com
2 consumer.krxd.net cdn.krxd.net
2 ap.lijit.com 1 redirects s.amazon-adsystem.com
2 amazon-tam-match.dotomi.com 2 redirects
2 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com securepubads.g.doubleclick.net
tagan.adlightning.com
2 jadserve.postrelease.com 1 redirects tagan.adlightning.com
2 uat5-a.investingchannel.com dggaenaawxe8z.cloudfront.net
2 pmp.mxptint.net 1 redirects ads.pubmatic.com
2 pubmatic-match.dotomi.com 2 redirects
2 image4.pubmatic.com ads.pubmatic.com
2 pippio.com 2 redirects
2 px.owneriq.net 2 redirects
2 sync.1rx.io 2 redirects
2 a.tribalfusion.com 2 redirects
2 cm.adgrx.com 2 redirects
2 prebid.media.net a.pub.network
2 tlx.3lift.com a.pub.network
2 freestar-d.openx.net a.pub.network
2 grid.bidswitch.net a.pub.network
2 htlb.casalemedia.com a.pub.network
2 fastlane.rubiconproject.com a.pub.network
2 api.floors.dev a.pub.network
2 www.reddit.com s9.addthis.com
2 secure-assets.rubiconproject.com 2 redirects
2 ssum.casalemedia.com 2 redirects
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 cds.connatix.com www.bleepingcomputer.com
cd.connatix.com
1 tag.idsync.analytics.yahoo.com tag.sp.advertising.com
1 tag.sp.advertising.com cdn-ssl.vidible.tv
1 sync.extend.tv 1 redirects
1 gu.dyntrk.com ssum-sec.casalemedia.com
1 rtb.gumgum.com ads.pubmatic.com
1 match.adsby.bidtheatre.com 1 redirects
1 ads.playground.xyz 1 redirects
1 mwzeom.zeotap.com ads.pubmatic.com
1 spl.zeotap.com 1 redirects
1 pixel.onaudience.com 1 redirects
1 core.iprom.net ads.pubmatic.com
1 csync.loopme.me 1 redirects
1 gocm.c.appier.net 1 redirects
1 match.taboola.com ads.pubmatic.com
1 trc.taboola.com 1 redirects
1 cms-xch.33across.com 1 redirects
1 biddr.brealtime.com a.pub.network
1 mb.moatads.com z.moatads.com
1 geo.moatads.com z.moatads.com
1 rtb.openx.net 1 redirects
1 e.dlx.addthis.com 1 redirects
1 cms.quantserve.com 1 redirects
1 fei.pro-market.net 1 redirects
1 ib.mookie1.com www.bleepingcomputer.com
1 global.ib-ibi.com 1 redirects
1 ps.eyeota.net www.bleepingcomputer.com
1 usermatch.krxd.net 1 redirects
1 ws.rqtrk.eu www.bleepingcomputer.com
1 aorta.clickagy.com 1 redirects
1 pixel-eu.rubiconproject.com 1 redirects
1 bttrack.com 1 redirects
1 sync-pp.ads.yieldmo.com sync-amz.ads.yieldmo.com
1 bh.contextweb.com 1 redirects
1 ad4m.at ssum-sec.casalemedia.com
1 sync.inmobi.com 1 redirects
1 ssbsync-us.smartadserver.com 1 redirects
1 sync-amz.ads.yieldmo.com s.amazon-adsystem.com
1 ads.yahoo.com eus.rubiconproject.com
1 ck.connatix.com 1 redirects
1 hb.emxdgt.com a.pub.network
1 rules.quantcount.com secure.quantserve.com
1 cdn.id5-sync.com tagan.adlightning.com
1 secure.cdn.fastclick.net tagan.adlightning.com
1 sync.resetdigital.co 1 redirects
1 sync.ipredictive.com 1 redirects
1 rtb.adentifi.com ads.pubmatic.com
1 tags.rd.linksynergy.com 1 redirects
1 mweb.ck.inmobi.com 1 redirects
1 ums.acuityplatform.com 1 redirects
1 sync.targeting.unrulymedia.com 1 redirects
1 match.bnmla.com ads.pubmatic.com
1 s.tribalfusion.com ads.pubmatic.com
1 match.deepintent.com ads.pubmatic.com
1 ssc.33across.com a.pub.network
1 s.ntv.io a.pub.network
1 dggaenaawxe8z.cloudfront.net a.pub.network
1 secure.quantserve.com a.pub.network
1 api.btloader.com freestar-io.videoplayerhub.com
1 ad-delivery.net www.bleepingcomputer.com
1 api-public.addthis.com s9.addthis.com
1 sync.technoratimedia.com 1 redirects
1 vid.connatix.com cd.connatix.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 btloader.com www.bleepingcomputer.com
1 freestar-io.videoplayerhub.com 1 redirects
1 pghub.io a.pub.network
1 cdn.firstimpression.io ecdn.firstimpression.io
1 m.addthis.com s9.addthis.com
1 v1.addthisedge.com s9.addthis.com
1 widgets.outbrain.com www.bleepingcomputer.com
1 ecdn.firstimpression.io www.bleepingcomputer.com
1 ecdn.analysis.fi www.bleepingcomputer.com
1 cd.connatix.com 1 redirects
1 static.cloudflareinsights.com www.bleepingcomputer.com
1 s9.addthis.com www.bleepingcomputer.com
1 www.googletagmanager.com www.bleepingcomputer.com
931 233
Subject Issuer Validity Valid
bleepingcomputer.com
Sectigo RSA Domain Validation Secure Server CA		 2020-05-16 -
2022-05-15		 2 years crt.sh
upload.video.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-16 -
2022-06-15		 a year crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-20 -
2022-10-19		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2021-04-25 -
2022-04-27		 a year crt.sh
analysis.fi
Amazon		 2021-12-04 -
2023-01-01		 a year crt.sh
*.firstimpression.io
Sectigo RSA Domain Validation Secure Server CA		 2021-11-21 -
2022-12-05		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.pub.network
Go Daddy Secure Certificate Authority - G2		 2021-03-17 -
2022-04-18		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA		 2021-05-25 -
2022-06-01		 a year crt.sh
*.scorecardresearch.com
Amazon		 2021-02-28 -
2022-03-29		 a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2021-08-20 -
2022-09-21		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2021-01-21 -
2022-01-25		 a year crt.sh
*.pghub.io
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-09 -
2022-02-16		 a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-24 -
2022-03-23		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-04-01 -
2022-04-04		 a year crt.sh
*.pubmatic.com
DigiCert SHA2 Secure Server CA		 2021-03-30 -
2022-04-04		 a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-05 -
2022-04-02		 6 months crt.sh
*.springserve.com
Amazon		 2021-09-27 -
2022-10-26		 a year crt.sh
api.floors.dev
GTS CA 1D4		 2021-10-21 -
2022-01-19		 3 months crt.sh
api.btloader.com
GTS CA 1D4		 2021-10-26 -
2022-01-24		 3 months crt.sh
c.amazon-adsystem.com
Amazon		 2021-07-06 -
2022-06-27		 a year crt.sh
*.adlightning.com
Amazon		 2021-06-24 -
2022-07-23		 a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
*.cloudfront.net
Amazon		 2021-03-19 -
2022-03-17		 a year crt.sh
*.ntv.io
DigiCert SHA2 Secure Server CA		 2021-01-25 -
2022-02-01		 a year crt.sh
districtm.io
Cloudflare Inc ECC CA-3		 2021-06-02 -
2022-06-01		 a year crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2020-04-23 -
2022-05-04		 2 years crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-14 -
2022-04-06		 6 months crt.sh
*.yieldmo.com
Amazon		 2021-10-12 -
2022-11-10		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
ssc.33across.com
GTS CA 1D4		 2021-11-26 -
2022-02-24		 3 months crt.sh
*.3lift.com
Amazon		 2021-06-12 -
2022-07-11		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2021-03-05 -
2022-02-19		 a year crt.sh
*.sharethrough.com
Amazon		 2021-08-13 -
2022-09-11		 a year crt.sh
*.media.net
Sectigo RSA Domain Validation Secure Server CA		 2021-04-12 -
2022-05-05		 a year crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018		 2021-03-11 -
2022-02-07		 a year crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-19 -
2022-04-13		 6 months crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
*.match.prod.bidr.io
Amazon		 2021-02-26 -
2022-03-27		 a year crt.sh
*.us.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-11-03 -
2022-01-31		 3 months crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.bnmla.com
Go Daddy Secure Certificate Authority - G2		 2021-01-06 -
2022-02-07		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-08-24 -
2022-02-16		 6 months crt.sh
adentifi.com
Amazon		 2021-09-04 -
2022-10-03		 a year crt.sh
secure.cdn.fastclick.net
DigiCert SHA2 Secure Server CA		 2021-03-11 -
2022-03-15		 a year crt.sh
cdn.id5-sync.com
R3		 2021-11-24 -
2022-02-22		 3 months crt.sh
*.emxdgt.com
Amazon		 2021-07-03 -
2022-08-01		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
cdn.krxd.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2021-02-08 -
2022-02-07		 a year crt.sh
*.investingchannel.com
Go Daddy Secure Certificate Authority - G2		 2020-05-26 -
2022-06-01		 2 years crt.sh
*.postrelease.com
Amazon		 2021-01-28 -
2022-02-25		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
s.amazon-adsystem.com
Amazon		 2021-07-14 -
2022-06-27		 a year crt.sh
acds.prod.vidible.tv
DigiCert SHA2 High Assurance Server CA		 2021-11-16 -
2022-05-11		 6 months crt.sh
*.id5-sync.com
R3		 2021-10-05 -
2022-01-03		 3 months crt.sh
cdn-ycs.vidible.tv
DigiCert SHA2 High Assurance Server CA		 2021-10-19 -
2022-04-06		 6 months crt.sh
trk.vidible.tv
DigiCert SHA2 High Assurance Server CA		 2021-07-11 -
2022-01-05		 6 months crt.sh
*.ads.yieldmo.com
Amazon		 2021-05-25 -
2022-06-23		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
consumer.krxd.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-13 -
2022-07-12		 a year crt.sh
fw.adsafeprotected.com
Amazon		 2021-08-11 -
2022-09-09		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
*.truste.com
Amazon		 2021-02-16 -
2022-03-17		 a year crt.sh
*.storage.googleapis.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
static.adsafeprotected.com
Amazon		 2021-09-05 -
2022-10-04		 a year crt.sh
dt.adsafeprotected.com
Amazon		 2021-04-22 -
2022-05-21		 a year crt.sh
beacon.krxd.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-03 -
2022-11-02		 a year crt.sh
*.eyeota.net
R3		 2021-10-26 -
2022-01-24		 3 months crt.sh
*.moatads.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-25 -
2022-06-25		 a year crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
*.brealtime.com
Go Daddy Secure Certificate Authority - G2		 2020-01-22 -
2022-03-22		 2 years crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2021-09-30 -
2022-03-30		 6 months crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-12-01 -
2022-02-26		 3 months crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-28 -
2022-12-29		 a year crt.sh
beacon.lynx.cognitivlabs.com
Amazon		 2021-04-28 -
2022-05-27		 a year crt.sh
*.iprom.net
R3		 2021-10-04 -
2022-01-02		 3 months crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh
*.gumgum.com
Amazon		 2021-10-15 -
2022-11-12		 a year crt.sh
*.dyntrk.com
R3		 2021-10-23 -
2022-01-21		 3 months crt.sh
um3.eqads.com
Amazon		 2021-06-26 -
2022-07-25		 a year crt.sh
tag.sp.advertising.com
DigiCert SHA2 Secure Server CA		 2020-04-02 -
2022-05-12		 2 years crt.sh
*.trustarc.com
Go Daddy Secure Certificate Authority - G2		 2020-05-21 -
2022-07-17		 2 years crt.sh
*.idsync.analytics.yahoo.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-28 -
2022-06-02		 a year crt.sh

This page contains 123 frames:

Primary Page: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Frame ID: A1F604E45A3225C8B0D8BAC8D62AB82B
Requests: 246 HTTP requests in this frame

Frame: https://cds.connatix.com/p/140482/connatix.playspace.js
Frame ID: A2660292B75B128F0F169C84B81922F1
Requests: 25 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Fwww.bleepingcomputer.com
Frame ID: 7CB4385450B37DE303AA8CEE107432B7
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/zrt_lookup.html
Frame ID: B5C3D0AAE7EBC4E0736B06A3E2C6F15B
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 9239DD3416F2385E0BAA1EC8BEC26975
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: A5CB502662CA41D767F404C3DDBA0E80
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Frame ID: 980988AF8B448407B6388E5C58E7875E
Requests: 29 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1637072838&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675833&bpp=1&bdt=444&idt=353&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=3065587345819&frm=20&pv=1&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=363
Frame ID: E17D0EB3CE429F4E5308A01E2C4D89CE
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Frame ID: CFD6FACBAAF9A82BC6148B77BE76220A
Requests: 12 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Frame ID: 51C23B72115DDC07E41726926162A987
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Frame ID: F1E399B6BDEFB7B771EC6265C405FE71
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Frame ID: 09552C58E45CB76C8F467BD725789932
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Frame ID: 4B4A44EB235B6A484E51791213F83F05
Requests: 23 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 55A45AE4291375D0AB9FBA14C688CEF4
Requests: 1 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_25214542.js
Frame ID: 5F91398D57F1028DA1A0AD7796109FA6
Requests: 11 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 2CDD332FD849BD747BC0AC85361D06AA
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 4C8D3678BF64B3CC7996A3E0B8AB5955
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Frame ID: CF4638100CD5859F7597A9AE39E6AE6E
Requests: 17 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Frame ID: 3F7F6FC7BA286831BC9B345D3DFDC721
Requests: 21 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 83164F65F66449C0A1438BB6032A028B
Requests: 3 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Frame ID: 80910228E612C883B1F42558FD06C2F7
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YawZhQAJhLX5VAAz&gdpr=0&gdpr_consent=&_test=YawZhQAJhLX5VAAz
Frame ID: 7D8BAAE1109AD84D8554FE652F484BAF
Requests: 1 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Frame ID: 6BD455C347A12F84852A66BED16AD691
Requests: 1 HTTP requests in this frame

Frame: https://widget.us.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 0FB596C141560BE83817EBA46E9D6717
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Frame ID: AA5E2B6937F785DA679708A65287C7BA
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e798f20a-556c-11ec-a6a1-d15af7eee1bc
Frame ID: C8B914A8BA36EFE272DAF18E0645DBE7
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=fjjYmhumTpxKx2Vf1I9_oCV4zbY
Frame ID: E2F69A13388A7436DC3F9574696F8286
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 967A86F7C3DFFFE9D2FA953A5B94A40E
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:IoqlAHf41MTGzX5&gdpr=0&gdpr_consent=
Frame ID: B2FD75666E27028C35A90E9154650C08
Requests: 1 HTTP requests in this frame

Frame: https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Frame ID: 5A5AD07F1C5E2D332731A4A17E1F5699
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005
Frame ID: 3DCFF24D262E42421FA7209C9C92335C
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627775726303
Frame ID: 7C66BAC6141544DF1E4881CE839E686B
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=2136b91a-fbec-4195-88cb-b89bb6bd2966
Frame ID: 64C08684E8B5E2ED9862114B77400030
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919550771882466910
Frame ID: DF59A05BCF02258CB8F3E4C507B6BD2D
Requests: 1 HTTP requests in this frame

Frame: https://capi.connatix.com/core/us?DemandPartner=2&UserId=cee0a083e7aa41ee905839ad8069ffb9&DemandPartnerName=Pubmatic&DemandPartnerUserId=F458BC18-DC0D-48F9-98CC-615D57A2C396
Frame ID: C22F927C7A7E32A2182F9A5547ACCB55
Requests: 1 HTTP requests in this frame

Frame: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 28ACC5041E8033479E330E36D5DF837C
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Frame ID: CCA6CD7C403E68F9F8DBCC992C3ACDA6
Requests: 1 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=8789babb-2040-41c2-8c48-492019dbef06&pblob=
Frame ID: 4872599D87F9FF04D8EF0D22CD47CD0D
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Frame ID: E98FED93C0505BB37B33445A8F44AA70
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Frame ID: 9C4935687EBE4706158B36874F6DB938
Requests: 11 HTTP requests in this frame

Frame: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 5C28406AA59043CB1A56F01C90CC2617
Requests: 17 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Frame ID: 030331F9B67C92DD4FDEC9C2AA9AADF8
Requests: 2 HTTP requests in this frame

Frame: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Frame ID: 69F705BAFD312D827E29B62314BBBDF5
Requests: 15 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Frame ID: 9784F548AE1A5171D03CFD4FC7EDE3DF
Requests: 10 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: 6F35CA3C0335ECD6C307CF0F19897EF6
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Frame ID: 1047BD649AED82965E4B35BBDC1EC830
Requests: 1 HTTP requests in this frame

Frame: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Frame ID: 9F6A84714A8A66E583B677B919C301B0
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: 9F5CA18B61A0A9D1BC27223279CA6AC9
Requests: 3 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8861207277885483119&gdpr=0&gdpr_consent=
Frame ID: 78E12CC1DBA93BA1718F669BCCE2AC73
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOX6sleXF7_9ReCQDqXLd6m1O6SQ9WrsHmXrIgsQ
Frame ID: F92901CF62CF6B529463D83A73E4F20B
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdXSNZEOKKQNisyUVAAAAAAA&expiration=1638755079&is_secure=true
Frame ID: 19A716BB747F33CDA551AD97A7D5A84A
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Frame ID: 7E12659781C0B2D359E4EA71D1E7CBC4
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=5223479661490903678
Frame ID: 46CE9D6557814355769AE63DA85FBD17
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 0A31853553753DAFA1AE1AB22566F793
Requests: 2 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 3D378F782E137329D2DCB901FC9716CD
Requests: 7 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: F0A30ACCAE13914B861BCEBC68249849
Requests: 30 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: 5491FE50B77DB648489CBF315E554290
Requests: 27 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: 08B569C3B8D6CD86BAF0279351728C1D
Requests: 27 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNXcqIVGtIscCevGz1LP0Xy04FOpS3fvgdcStKI9fTwAMzNB5m3BsRRc_RcwqCAb4x-l6KE81D9e3eOu5cWQDxhR2ZwnjQ
Frame ID: 8ABEA07B77730AD5A780A57D5FE7F156
Requests: 5 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: 424895874ABC7750DEE578D114F6293A
Requests: 39 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: ADE7B4DAE4B85298AC94AEC119065A5B
Requests: 27 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: FFFAF6A1CC3CE381473C783B862F779F
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Frame ID: 617F40DC89EFBC79E6A0D37BC059B206
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 0EE3FEF20C39F45D8868CAE161B7CA07
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: E6DF067ECED90C72D121A4A4FC8D61C8
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: C2BD967CEC721914FE667550241CC64D
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: FDD5335DB0504E7DDEFF85C94923E34C
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: AAFD8065637E8ABB39D2FCD4819855EB
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 66BE30323F82525993D404E16307C20F
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Frame ID: 734DF4C3A4C00486A888433A7FB53C55
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 675FB54D2B3E9BF094968B9DD28C637B
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Frame ID: F92B97B24464E71B0A744132BBF3870C
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Frame ID: 5C5E6484EC534A5A6210181128EB9BCC
Requests: 3 HTTP requests in this frame

Frame: https://storage.googleapis.com/session-hub/index.html
Frame ID: BB02396126083D38BC8DBB261493C10A
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Frame ID: 034BFC70F2F8172C9DBABB51B46988C7
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Frame ID: 09E2BB13D761A2DE4633A69032126BA3
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Frame ID: 2D75ADAD37CB5BA35F5EF604CA303269
Requests: 3 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_25214542.js
Frame ID: 3FC7319C08F84A5E58182409B85121A9
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 24572702FAC88CDB1E2990D7C4BB53AC
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 91ADA49FFB72A8D4961DD09AE670E9A9
Requests: 3 HTTP requests in this frame

Frame: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Frame ID: 24CCC61FC79852ED3AD0704EFB1EC0E5
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 69CD420C9ED2F1D17BE7D8A60209CA69
Requests: 11 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 14D996B76148795FF057DBDA1AC1BA06
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: 75A8AD4E3E565B4E5D609F13C3092057
Requests: 15 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 3938BA067D89ABEF7A3BC4FBDDC2F18B
Requests: 2 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.html
Frame ID: BC761CFA885787DF6FD663A79D92CBAF
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 33EBDA4D8031C148EF4712A62FBD415E
Requests: 11 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Frame ID: D5707E420569E6117B000731744F33C4
Requests: 11 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: AACE269D92A3B92A6EA5D8A50A198CCB
Requests: 11 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: F7F3D95F243C6EB748107EA5C5242C3A
Requests: 15 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: D53A1AAF90E54CEA73BB77F203733276
Requests: 8 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: A84707BB6074887772CDDEE145614C85
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: A94DCAF875E7A344278E520ED4A71AD6
Requests: 2 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 381BB25DC2F75AFDE5811653491DE6FB
Requests: 9 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Frame ID: 144D6ED6396A7B0E826AAE89D787D67A
Requests: 11 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: F6ED6AFB823F95F91BF20B3324D69978
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: C3E35FC74A1A8A583B3002B12C938E7E
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B117A43E6496BD997ECA289DDF65C41E
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 014D0CA12EA87886CFD6F9251016F2FB
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4B3D15C407F9E8D87FD4E1090F1E01E7
Requests: 3 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: 8EDCAD9DE439DBD46FE213AC1338F315
Requests: 9 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: ECA104113BC38C16F7C9030FF8D5AD43
Requests: 10 HTTP requests in this frame

Frame: https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841112816702837397404000V10&ovsid=979321821552651232
Frame ID: 5FABB18FEFABECB1F673397BF42A25AA
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841522816702837397404000V10&ovsid=979321821552651232
Frame ID: E72F4AF40B5BC3668E736539FE26EF9B
Requests: 1 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=6afacd1e-1950-4d89-a104-277b55ddc0b4&pblob=
Frame ID: 8210A7F742F1E2AC5F3FBD14C05ED655
Requests: 9 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Frame ID: B142238EC5CD7C3E3091501207E5D7DF
Requests: 3 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=c37cf53a-b31d-44ca-8259-d06cf5f5798d-tuct8a59f0c&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: 9B06B1BFF8F19BABE3CBBCB351AC342A
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sSE8PgZVA8-yk7I4jRmsYQ
Frame ID: 4C10320C66B3D9E2B8F6D36900EE00BD
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Frame ID: EC719147F539182878CE94D6BD206268
Requests: 1 HTTP requests in this frame

Frame: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Frame ID: 238989C66D5502804C955F0A8DD36B2B
Requests: 1 HTTP requests in this frame

Frame: https://core.iprom.net/cookiesync
Frame ID: D9B89334A52AF5CE39CA80746238F92D
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
Frame ID: 21DD18C3FB88677C7D5DC2A4E7C6270D
Requests: 1 HTTP requests in this frame

Frame: https://um2.eqads.com/um/cs&eq_cc=1
Frame ID: 3FF7780279B0E3B1363059A332C0CC75
Requests: 2 HTTP requests in this frame

Frame: https://tag.idsync.analytics.yahoo.com/sp-frame.html?referrer=
Frame ID: 1671B8D0FAC1CB99157E827A7C198888
Requests: 1 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 660EEE16AF95B7A080791D07230C930B
Requests: 2 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 79C8C2B76B37EF5ED7D4DBB4779AAA62
Requests: 2 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 1203E471991985DDE41D7F0B986CA2D2
Requests: 2 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 08B6143D0C38B08ED61975B6C011ECD9
Requests: 2 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 84C239FE1224BE14F7634C6890FA1333
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 9165FAAC1D419BAD9D4DEEF282CE8AEB
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 185365597B4CA016C443CBE269365D42
Requests: 2 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_25214542.js
Frame ID: 6B0CE4602000157579209F49033075EC
Requests: 9 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=18f91ee7-365b-48e2-8922-e9616f032685&pblob=
Frame ID: 03EDA7D5F4F9726852DA0755DAE8F472
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Emotet malware is back and rebuilding its botnet via TrickBotFacebookTwitterLinkedInRedditHacker NewsEmailFacebookTwitterLinkedInEmail

Page Statistics

931
Requests

81 %
HTTPS

21 %
IPv6

132
Domains

233
Subdomains

145
IPs

11
Countries

9305 kB
Transfer

25531 kB
Size

249
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 301
  • https://www.gstatic.com/prose/brandjs.js
Request Chain 25
  • https://cd.connatix.com/connatix.playspace.js HTTP 302
  • https://cds.connatix.com/p/140482/connatix.playspace.js
Request Chain 68
  • https://freestar-io.videoplayerhub.com/gallery.js HTTP 301
  • https://btloader.com/tag?h=freestar-io&upapi=true
Request Chain 71
  • https://sb.scorecardresearch.com/b?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638668676124&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638668676124&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9=
Request Chain 88
  • https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d17%26ev%3dcee0a083e7aa41ee905839ad8069ffb9%26pname%3dIndex%26uid%3d HTTP 302
  • https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3Dcee0a083e7aa41ee905839ad8069ffb9%26pname%3DIndex%26uid%3D&s=190549&C=1 HTTP 302
  • https://cks.connatix.com/cks?pid=17&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=Index&uid=YawZhBbaf-sLobsSgmffIQAA%26075
Request Chain 89
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gapzaid&ttd_tpi=1 HTTP 302
  • https://cks.connatix.com/cks?pid=19&uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttl=1641260676
Request Chain 90
  • https://secure.adnxs.com/getuid?https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d6%26ev%3dcee0a083e7aa41ee905839ad8069ffb9%26pname%3dAppNexus%26uid%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fcks.connatix.com%252fcks%253fpid%253d6%2526ev%253dcee0a083e7aa41ee905839ad8069ffb9%2526pname%253dAppNexus%2526uid%253d%2524UID HTTP 302
  • https://cks.connatix.com/cks?pid=6&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=AppNexus&uid=8987304192775495297
Request Chain 91
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Request Chain 93
  • https://us-u.openx.net/w/1.0/cm?id=7cf4c6c4-b915-4cbd-83cc-28c0f662a829&ph=51e220cb-8c97-4a65-b047-91c933b79b78&&r=%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D8%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerUserId%3D HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=7cf4c6c4-b915-4cbd-83cc-28c0f662a829&ph=51e220cb-8c97-4a65-b047-91c933b79b78&&r=%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D8%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerUserId%3D HTTP 302
  • https://capi.connatix.com/core/us?DemandPartner=8&UserId=cee0a083e7aa41ee905839ad8069ffb9&DemandPartnerUserId=8645db9c-e843-09c1-3274-4da3d40f88b0
Request Chain 94
  • https://sync.technoratimedia.com/services?srv=cs&pid=70&uid=cee0a083e7aa41ee905839ad8069ffb9&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d26%26ev%3dcee0a083e7aa41ee905839ad8069ffb9%26pname%3dSynacor%26uid%3D%5BUSER_ID%5D%26direct%3D1 HTTP 307
  • https://cks.connatix.com/cks?pid=26&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=Synacor&uid=A44A121B6711404BB5C1FC98E5E2423F&direct=1 HTTP 302
  • https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=A44A121B6711404BB5C1FC98E5E2423F&UserId=
Request Chain 171
  • https://c1.adform.net/serving/cookie/match?party=14&cid=F458BC18-DC0D-48F9-98CC-615D57A2C396 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Request Chain 172
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YawZhQAJhLX5VAAz HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YawZhQAJhLX5VAAz&gdpr=0&gdpr_consent=&_test=YawZhQAJhLX5VAAz
Request Chain 173
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFGWWFFN0RXRE1BQUN1WG5naTdWdw&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Request Chain 174
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
  • https://widget.us.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Request Chain 176
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e798f20a-556c-11ec-a6a1-d15af7eee1bc
Request Chain 177
  • https://sync.srv.stackadapt.com/sync?nid=11 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=fjjYmhumTpxKx2Vf1I9_oCV4zbY
Request Chain 178
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 179
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:IoqlAHf41MTGzX5&gdpr=0&gdpr_consent=
Request Chain 181
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8177775240 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/7de5ca57-c954-4db1-bc90-ae26323dfac5 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005
Request Chain 182
  • https://ums.acuityplatform.com/tum?umid=6 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627775726303
Request Chain 183
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=2136b91a-fbec-4195-88cb-b89bb6bd2966
Request Chain 184
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ6919550771882466910&uid=Q6919550771882466910&ref=%2Fepm HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919550771882466910
Request Chain 186
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9Fi8GNwNSPmYzGFdV6LDlg%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 187
  • https://idsync.rlcdn.com/420486.gif?partner_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEY0NThCQzE4LURDMEQtNDhGOS05OENDLTYxNUQ1N0EyQzM5NhAAGg0IhbOwjQYSBQjoBxAAQgBKAA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=7634a8b55d5d17697c837fabe067bae90b90bd00f44939de46d464690f169edb791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA3NjM0YThiNTVkNWQxNzY5N2M4MzdmYWJlMDY3YmFlOTBiOTBiZDAwZjQ0OTM5ZGU0NmQ0NjQ2OTBmMTY5ZWRiNzkxNDI2YjU0MTdkY2UyMRAAGgwIhbOwjQYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA3NjM0YThiNTVkNWQxNzY5N2M4MzdmYWJlMDY3YmFlOTBiOTBiZDAwZjQ0OTM5ZGU0NmQ0NjQ2OTBmMTY5ZWRiNzkxNDI2YjU0MTdkY2UyMRAAGgwIhbOwjQYSBAgCEABCAEoA&google_gid=CAESEPcWH3lBFyDpD-BqjTOwgLs&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=ec534934-9cc6-4add-95e8-09698ea33a4c
Request Chain 188
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=80ca61ac-1985-4400-a48d-b90a57bd0cef
Request Chain 189
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjQ1OEJDMTgtREMwRC00OEY5LTk4Q0MtNjE1RDU3QTJDMzk2&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 190
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECQ-IpU7YaeY8-QgpjBoaHI&google_cver=1
Request Chain 191
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
Request Chain 192
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 193
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7de5ca57-c954-4db1-bc90-ae26323dfac5
Request Chain 194
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:badc61ac-1985-4000-9788-0d2b1d82255b&gdpr=0&gdpr_consent=
Request Chain 195
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-ecqHBIxE2uVNT64m3DWaV2XDOBvGQcM-~A&gdpr=0&gdpr_consent=
Request Chain 197
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8987304192775495297&gdpr=0&gdpr_consent=
Request Chain 198
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=0&gdpr_consent= HTTP 302
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=39ddf25e9e041204&is_secure=true&networkId=17100&version=1&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGZoispQrBKwNStWDnAAAAAAA&expiration=1638755078&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&is_secure=true&gdpr_consent=&gdpr=0
Request Chain 200
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e7d04ec6-556c-11ec-b6dc-73502c1f30ef&gdpr=0&gdpr_consent=
Request Chain 201
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1D531_E7994491_27E6AF978&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
  • https://pmp.mxptint.net/sn.ashx?ak=1
Request Chain 202
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&gdpr=0&gdpr_consent=
Request Chain 203
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=QFKA4Uda2bdbVNnjF1XMs0AF1LBbUNbmFFMfEY-s
Request Chain 204
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718 HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=445d1fc1-46d4-494d-842f-cfe15cd6e197&ssp=pubmatic HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 205
  • https://sync.resetdigital.co:10001/csync/pubmatic HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA38D9B9F
Request Chain 255
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=19564_2 HTTP 302
  • https://ck.connatix.com/cks?pid=11&uid=KWSL0RE8-3-ILJG HTTP 302
  • https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL0RE8-3-ILJG&UserId=
Request Chain 265
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/eUHPBa6A6YVH7HoShjuCtQ?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3913413988169684362
Request Chain 266
  • https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTIyMGM4OWI1YmFiYWFlZDJiMTBiYTkyNmI4NjU3NTFmOTc4OWNkNw
Request Chain 267
  • https://match.adsrvr.org/track/cmf/rubicon HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=&expires=30
Request Chain 268
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH
Request Chain 269
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YawZhQAJhLX5VAAz
Request Chain 271
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=badc61ac-1985-4000-9788-0d2b1d82255b&expires=28
Request Chain 272
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWSL0RE8-3-ILJG&sigv=1&esig=2~f5d4f115f7338e69422e260c048d59e3fc9a15fc
Request Chain 284
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Request Chain 332
  • https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=DBE6805D465846A3966128D6AD5D95CA&ex=simpli.fi&status=ok
Request Chain 338
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8861207277885483119&gdpr=0&gdpr_consent=
Request Chain 339
  • https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D HTTP 302
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOX6sleXF7_9ReCQDqXLd6m1O6SQ9WrsHmXrIgsQ
Request Chain 340
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=b865590ae36122f&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdXSNZEOKKQNisyUVAAAAAAA&expiration=1638755079&is_secure=true
Request Chain 341
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com HTTP 302
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Request Chain 342
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=5223479661490903678
Request Chain 370
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YawZhBbaf-sLobsSgmffIQAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
Request Chain 372
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_cver=1
Request Chain 373
  • https://match.adsrvr.org/track/cmf/casale HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&expiration=1641260679&gdpr=0&gdpr_consent=
Request Chain 377
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Dd92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341%26partner_url%3Dhttps%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253Dd92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341%2526expiration%253D1641260679 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Dd92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341%26partner_url%3Dhttps%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253Dd92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341%2526expiration%253D1641260679&xl8blockcheck=1 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&partner_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D64%26external_user_id%3Dd92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341%26expiration%3D1641260679 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&partner_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D64%26external_user_id%3Dd92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341%26expiration%3D1641260679 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&expiration=1641260679
Request Chain 380
  • https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an HTTP 302
  • https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=8987304192775495297&pn_id=an
Request Chain 381
  • https://x.bidswitch.net/sync?&ssp=yieldmo HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=yieldmo&ssp_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=74&&user_id=171119515&expires=5&ssp=yieldmo HTTP 302
  • https://ads.yieldmo.com/sync?userid=e844459d-39b0-402c-bf5a-7640e7a8c718&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Request Chain 382
  • https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo HTTP 302
  • https://ads.yieldmo.com/v000/sync?tdid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Request Chain 383
  • https://sync.srv.stackadapt.com/sync?&nid=21 HTTP 302
  • https://ads.yieldmo.com/sync?pn_id=stk&userid=fjjYmhumTpxKx2Vf1I9_oCV4zbY
Request Chain 384
  • https://bh.contextweb.com/bh/rtset?&pid=561118&ev=1&rurl=https://sync-pp.ads.yieldmo.com/sync?userid=%%VGUID%%&pn_id=pp HTTP 302
  • https://sync-pp.ads.yieldmo.com/sync?userid=355Kb29h0Wqs&ev=1&pn_id=pp&pid=561118
Request Chain 386
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=18694 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL0RE8-3-ILJG
Request Chain 387
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
Request Chain 388
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
Request Chain 389
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
  • https://bttrack.com/pixel/cookiesync?source=d0afdff5-c51e-4a8d-b07b-b52a29015170&secure=1 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=72c611fb-f28e-4ff5-b0be-f4db517a6bb3
Request Chain 410
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1 HTTP 302
  • https://ce.lijit.com/merge?pid=86&3pid=nxh61y00tA73Nuy4zCQ9&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
Request Chain 411
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=87&3pid=445d1fc1-46d4-494d-842f-cfe15cd6e197
Request Chain 412
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=83&3pid=KWSL0RE8-3-ILJG&gdpr=0
Request Chain 413
  • https://jadserve.postrelease.com/suid/101957?ntv_r=https://ce.lijit.com/merge?pid=90&3pid=NTV_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=90&3pid=c0b28e8e-dbbe-4d07-b7cb-3b1d688f17fb&gdpr=0&gdpr_consent=
Request Chain 414
  • https://aorta.clickagy.com/pixel.gif?ch=185&cm=37e1e7f6223a458ed25ab69d&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
Request Chain 420
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=KWSL0RE8-3-ILJG&ex=d-rubiconproject.com&status=ok
Request Chain 453
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
Request Chain 454
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YawZhBbaf-sLobsSgmffIQAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
Request Chain 455
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEBPX8qf5w4DoOXbBdrRs5Ig&google_cver=1
Request Chain 456
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk4NzMwNDE5Mjc3NTQ5NTI5Nw%3D%3D
Request Chain 473
  • https://ny1-bid.adsrvr.org/bid/feedback/appnexus?t=1&iid=9090efe1-fb9c-442d-803b-1d7ac113fa60&crid=oybxzi69&wp=2.334858&aid=3232489538087091304&wpc=USD&sfe=13e39985&puid=8987304192775495297&tdid=&pid=3i8jb8j&ag=vpjkvsm&adv=m4cpndh&sig=18emmpze4qouo4SFKJj9pHcN9I9vNUNA03gPrrrnoXE8.&bp=2.33485747640821&cf=2716329&fq=0&td_s=www.bleepingcomputer.com&rcats=2dx,obk,jba,yvb,3gs&mcat=&mste=&mfld=4&mssi=&mfsi=&uhow=164&agsa=&rgz=H3B&svbttd=1&dt=PC&osf=Windows&os=Windows10&br=Chrome&rlangs=en&mlang=&svpid=7125&did=1267594&rcxt=Other&lat=45.499400&lon=-73.570300&tmpc=-7.25&daid=&vp=0&osi=&osv=&mk=Google&mdl=Chrome%20-%20Windows&c=CgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..&dur=CkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.&durs=y6VEMw&crrelr=&adpt=anor&ipl=bleepingcomputer_300x250_300x600_160x600_Right_2/bleepingcomputer_300x250_300x600_160x600_Right_2&pcm=1&vc=3&said=7480474431045220042&ict=Unknown&auct=1&im=1&mc=ad038fb7-631f-47ff-86ff-2afd5470d9af HTTP 302
  • https://odr.mookie1.com/t/v2?tagid=V2_2087&src.visitorId=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10597814350218064749&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_2086%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26gdpr_consent%3D%26gdpr%3D0 HTTP 302
  • https://odr.mookie1.com/t/v2?tagid=V2_2086&src.visitorid=a507803e-3812-41e4-80b2-78e5739cd1db&gdpr_consent=&gdpr=0 HTTP 302
  • https://ws.rqtrk.eu/pushpull?dmp=8f69b95d-3b90-4a14-a0a2-c85909244e3f&uid=10597814350218064749&gdpr=1&gdpr_consent=&redirect=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_1004440%26src.visitorid%3D%24BROWSER_ID%26gdpr_consent%3D%24GDPR_CONSENT%26gdpr%3D%24GDPR
Request Chain 505
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 507
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497149/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&adsafe_type=abdq&adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2F&adsafe_type=f&adsafe_jsinfo=,id:9ef1eab2-63bf-ab8a-ec9f-720656398207,c:vSM0qQ,sl:outOfView,em:true,fr:true,thd:1,mn:app39va,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:0,obst:0,th:0,reas:r,br:u,abv:na,an:n,oam:0,nbld:0,mtim:3,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n*.877959-58497149%7C1o%7C1p%7C1q%7C1r%7C1s,idMap:1n*,pl:,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:39,oid:e995f309-556c-11ec-8353-0a5e4ae76b97,v:19.8.270,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://www.googletagservices.com/dcm/dcmads.js
Request Chain 509
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497149/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&adsafe_type=abdq&adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2F&adsafe_type=f&adsafe_jsinfo=,id:fbeef6d0-9e2b-05d0-75e9-91e9adffb828,c:vSM0rY,sl:outOfView,em:true,fr:true,thd:1,mn:app24va,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:268.5433.728.90,am:i,cc:268.5433.728.90,piv:0,obst:0,th:0,reas:r,br:u,abv:na,an:n,oam:0,nbld:0,mtim:2,fm:sQGaN0d+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n1%7C1o*.877959-58497149%7C1p%7C1q%7C1r%7C1s,idMap:1o*,pl:,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:42,oid:e9a5aa34-556c-11ec-8668-02371a8518a3,v:19.8.270,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://www.googletagservices.com/dcm/dcmads.js
Request Chain 512
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497151/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&adsafe_type=abdq&adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2F&adsafe_type=f&adsafe_jsinfo=,id:44b263a8-3dc5-6d0b-919c-cf65caeccc4c,c:vSM0tC,sl:outOfView,em:true,fr:true,thd:1,mn:app26va,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:1082.1627.300.250,am:i,cc:1082.1627.300.250,piv:0,obst:0,th:0,reas:r,br:u,abv:na,an:n,oam:0,nbld:0,mtim:4,fm:sQGaN1N+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n1%7C1o1%7C1p*.877959-58497151%7C1q%7C1r%7C1s,idMap:1p*,pl:,rmeas:1,rend:0,renddet:IMG.us.bi,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:42,oid:e9bd02cd-556c-11ec-9a8d-0e8bec96a15b,v:19.8.270,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://www.googletagservices.com/dcm/dcmads.js
Request Chain 517
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497147/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&adsafe_type=abdq&adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2F&adsafe_type=f&adsafe_jsinfo=,id:9a0fbde3-9ae8-f13c-53d9-a0aff1deee14,c:vSM0w8,sl:outOfView,em:true,fr:true,thd:1,mn:jsserver-primary-846854996-9fxpg,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:1082.2329.300.600,am:i,cc:1082.2329.300.600,piv:0,obst:0,th:0,reas:r,br:u,abv:na,an:n,oam:0,nbld:0,mtim:3,fm:sQGaN4k+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n1%7C1o1%7C1p1%7C1q*.877959-58497147%7C1r%7C1s,idMap:1q*,pl:,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:40,oid:e9ef8480-556c-11ec-bade-6674461fbe46,v:19.8.270,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://www.googletagservices.com/dcm/dcmads.js
Request Chain 519
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497149/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&adsafe_type=abdq&adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2F&adsafe_type=f&adsafe_jsinfo=,id:f3e67bff-2ad3-5ea8-e308-f3f0ed0d8a54,c:vSM0xF,sl:outOfView,em:true,fr:true,thd:1,mn:app06va,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:436.6945.728.90,am:i,cc:436.6945.728.90,piv:0,obst:0,th:0,reas:r,br:u,abv:na,an:n,oam:0,nbld:0,mtim:3,fm:sQGaN5T+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n1%7C1o1%7C1p1%7C1q1%7C1r*.877959-58497149%7C1s,idMap:1r*,pl:,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:39,oid:ea08b1d7-556c-11ec-8c82-02813368eb05,v:19.8.270,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://www.googletagservices.com/dcm/dcmads.js
Request Chain 528
  • https://usermatch.krxd.net/um/v2?partner=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T2hZcF9EN0Y HTTP 302
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
Request Chain 529
  • https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T2hZcF9EN0Y HTTP 302
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
Request Chain 530
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=OhYp_D7F&gdpr=0 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Request Chain 532
  • https://stags.bluekai.com/site/26357?id=OhYp_D7F&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOhYp_D7F%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID HTTP 302
  • https://beacon.krxd.net/usermatch.gif?_kuid=OhYp_D7F&partner=bluekai&bk_uuid=$_BK_UUID
Request Chain 535
  • https://ib.adnxs.com/getuid?https://beacon.krxd.net/usermatch.gif?adnxs_uid=$UID HTTP 302
  • https://beacon.krxd.net/usermatch.gif?adnxs_uid=8987304192775495297
Request Chain 536
  • https://global.ib-ibi.com/image.sbxx?go=247532&pid=314&xid=OhYp_D7F HTTP 302
  • https://ib.mookie1.com/image.sbxx?go=247532&pid=314&xid=OhYp_D7F
Request Chain 537
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dpubmatic%26partner_uid%3D%23PM_USER_ID HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Request Chain 538
  • https://fei.pro-market.net/engine?mimetype=img&du=88&csync=OhYp_D7F HTTP 302
  • https://idsync.rlcdn.com/398696.gif?partner_uid=-3328909297190025284
Request Chain 540
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 554
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIDNgzRxRAllHvkHcYSuh4U&google_cver=1&google_push=AYg5qPIPpJTBoIS3_n2kdpLSjSg8bm8xyt1ij9a5athl08J9ZPAgqhQ4jLbGplFkq_PrMCMdBLGrJxp1OT6VCzM46e-F70JN5Iis HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPIPpJTBoIS3_n2kdpLSjSg8bm8xyt1ij9a5athl08J9ZPAgqhQ4jLbGplFkq_PrMCMdBLGrJxp1OT6VCzM46e-F70JN5Iis&google_hm=O0YxuSrWVjeIf42R3egWfw
Request Chain 555
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLDuwKay2Wd2qh1O_hFsRlUEZjcHH7-fKoVbbFoXvRXwNQjrBx1NLiI_lfrNzj75LvnBaXzcAeBt0MM4CrHmZqSO4LomOMO&google_gid=CAESEKb-r2r2iFTFi0htTrXZZts&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTQ0MzYwMzIwMDg0MzEzMTM0OQ%3D%3D&google_push=AYg5qPLDuwKay2Wd2qh1O_hFsRlUEZjcHH7-fKoVbbFoXvRXwNQjrBx1NLiI_lfrNzj75LvnBaXzcAeBt0MM4CrHmZqSO4LomOMO
Request Chain 556
  • https://rtb.openx.net/sync/dds?google_gid=CAESECWpq2fTZ8n-Vc3IO6jRaDs&google_cver=1&google_push=AYg5qPJCf9Oat_JnI4u9eDy1K_J4OR8C0ghY1bdjQljYnw3gAbF-bcv5yL9064KkQUbiDg88sK4GZ4vfh4r7GIQHIrRl4i9yFzT8 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJCf9Oat_JnI4u9eDy1K_J4OR8C0ghY1bdjQljYnw3gAbF-bcv5yL9064KkQUbiDg88sK4GZ4vfh4r7GIQHIrRl4i9yFzT8&google_hm=lSkhB-hZjQCaEaIok53ZdA==
Request Chain 557
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEKfmSJMbOYy-IuY43swNYS4&google_cver=1&google_push=AYg5qPJjQUJASA0yzm-MnSBeGpbUOhJp6S_WDiAZiCKfA4uDUzE_fQwXAKejwbfvTQKZGndKJa4uzHL1bhtM6hyHnTd_vE2zQxxd HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9Fi8GNwNSPmYzGFdV6LDlg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJjQUJASA0yzm-MnSBeGpbUOhJp6S_WDiAZiCKfA4uDUzE_fQwXAKejwbfvTQKZGndKJa4uzHL1bhtM6hyHnTd_vE2zQxxd
Request Chain 558
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEA08bjXZLwQ8ILpk_YBAPnc&google_cver=1&google_push=AYg5qPLAU2o-0TA1z2K_uAu9c5jWnVAplaUT1KWACBJk0tC8pn8vjS6xNvSepCeJAN7fEts1_1DRzxsxHduE4Ff2tZ_aj-uEPEo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH&google_push=AYg5qPLAU2o-0TA1z2K_uAu9c5jWnVAplaUT1KWACBJk0tC8pn8vjS6xNvSepCeJAN7fEts1_1DRzxsxHduE4Ff2tZ_aj-uEPEo
Request Chain 559
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_cver=1&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u
Request Chain 560
  • https://cc.adingo.jp/adx/push/?google_gid=CAESELiRqzMTcmWEQdygDz_4UO4&google_cver=1&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5
Request Chain 643
  • https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined HTTP 302
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined HTTP 307
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Request Chain 660
  • https://x.bidswitch.net/sync?ssp=themediagrid HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=themediagrid HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=979321821552651232&expires=30&ssp=themediagrid
Request Chain 666
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ%3D HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEDco8xSPrxMTVwea5RPGrWs&google_cver=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDco8xSPrxMTVwea5RPGrWs&google_cver=1&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Request Chain 667
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=YawZhQAJhLX5VAAz&_origin=0&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YawZhQAJhLX5VAAz&_origin=0&gdpr=0&gdpr_consent=&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Request Chain 668
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&_origin=1&gdpr=0&gdpr_consent=
Request Chain 679
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
Request Chain 680
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 681
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
Request Chain 682
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent= HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent=&cookiesTest=true HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=e8cc3384036825b3d0d76f98b28a130a
Request Chain 683
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/5223479661490903678?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
Request Chain 684
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=5223479661490903678&gdpr=0&gdpr_consent= HTTP 302
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtriplelift%26bsw_param%3De844459d-39b0-402c-bf5a-7640e7a8c718%26gdpr%3D0%26consent%3D%26gdpr_pd%3D%26expires%3D7 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=6a9099fe149943558409bf11cf581e18&ssp=triplelift&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&consent=&gdpr_pd=&expires=7 HTTP 302
  • https://eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
Request Chain 687
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=clov18HnwPssF8vs3A5I&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5MNWG65RRHBEG452QONZUMODWOMZUCNKJ&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5MNWG65RRHBEG452QONZUMODWOMZUCNKJ HTTP 302
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=clov18HnwPssF8vs3A5I
Request Chain 688
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
Request Chain 689
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
Request Chain 690
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 691
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
Request Chain 692
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent= HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent=&cookiesTest=true HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=03815539ed5b596b1210606f155e6e8e
Request Chain 693
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/5223479661490903678?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
Request Chain 694
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=5223479661490903678&gdpr=0&gdpr_consent= HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=triplelift HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=4764934967218434204&ssp=triplelift HTTP 302
  • https://eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 697
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=Fwkk8MZfi77mYekkQ5yQ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5IZ3WW2ZYJVNGM2JXG5WVSZLLNNITK6KR&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5IZ3WW2ZYJVNGM2JXG5WVSZLLNNITK6KR HTTP 302
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fwkk8MZfi77mYekkQ5yQ
Request Chain 698
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
Request Chain 699
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID} HTTP 302
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7 HTTP 302
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Request Chain 700
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
  • https://id.rlcdn.com/464246.gif?partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216 HTTP 307
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216
Request Chain 701
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
Request Chain 703
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 704
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
Request Chain 706
  • https://match.adsrvr.org/track/cmf/openx?oxid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
Request Chain 708
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
Request Chain 709
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID} HTTP 302
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7 HTTP 302
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Request Chain 710
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
  • https://id.rlcdn.com/464246.gif?partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFe1o70PLgZZofw4kbnUoCU&google_cver=1
Request Chain 711
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
Request Chain 713
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 714
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
Request Chain 716
  • https://match.adsrvr.org/track/cmf/openx?oxid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
Request Chain 718
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
Request Chain 728
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Drkt%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ovsid%3D%7Buserid%7D HTTP 302
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841112816702837397404000V10&ovsid=979321821552651232
Request Chain 729
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dcon%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ovsid%3D%24UID HTTP 302
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=4e177ebba12a122e&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dcon%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ovsid%3D%24UID HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841112816702837397404000V10&ovsid=AAAGdRmaSRiJfwNLCneoAAAAAAA&expiration=1638755084&is_secure=true
Request Chain 730
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dmma%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ovsid%3D%5BMM_UUID%5D HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841112816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
Request Chain 731
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwMjgzNzM5NzQwNDAwMFYxMA%3D%3D&google_sc=1 HTTP 302
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
Request Chain 732
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ovsid%3D_wfivefivec_ HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841112816702837397404000V10&ovsid=IoqlAHf41MTGzX5
Request Chain 733
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://widget.us.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bcd0c355-6644-4105-a88b-337907a30096
Request Chain 734
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dmedianet%26bsw_param%3De844459d-39b0-402c-bf5a-7640e7a8c718%26gdpr%3D0%26consent%3D%26gdpr_pd%3D1%26expires%3D7 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=6a9099fe149943558409bf11cf581e18&ssp=medianet&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&consent=&gdpr_pd=1&expires=7 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&gdpr_consent=&gdpr_pd=1
Request Chain 735
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dzem%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ovsid%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=9-3_5eCUoYmiirPC7-_j&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJZFUZV6NLFINKW6WLNNFUXEUCDG4WV62RGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRYGY4DIMJRGEZDQMJWG4YDEOBTG4ZTSNZUGA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGI4DGNZTHE3TIMBUGAYDAVRRGA HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJZFUZV6NLFINKW6WLNNFUXEUCDG4WV62RGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRYGY4DIMJRGEZDQMJWG4YDEOBTG4ZTSNZUGA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGI4DGNZTHE3TIMBUGAYDAVRRGA HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&ovsid=9-3_5eCUoYmiirPC7-_j&refUrl=&type=zem&vid=86686841112816702837397404000V10&vsid=2816702837397404000V10
Request Chain 736
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816702837397404000V10 HTTP 302
  • https://contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
Request Chain 738
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1 HTTP 302
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Request Chain 739
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Damb%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ovsid%3D%23USER_ID%23 HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841112816702837397404000V10&ovsid=7864110075816986117
Request Chain 743
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwMjgzNzM5NzQwNDAwMFYxMA%3D%3D&google_sc=1 HTTP 302
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
Request Chain 744
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Drkt%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ovsid%3D%7Buserid%7D HTTP 302
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841522816702837397404000V10&ovsid=979321821552651232
Request Chain 745
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://widget.us.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=590dcce8-2386-42d6-b790-0496b3dda96c
Request Chain 746
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=medianet&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718&google_hm=ZTg0NDQ1OWQtMzliMC00MDJjLWJmNWEtNzY0MGU3YThjNzE4 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEEbTvjSvONRhZIc_lPCLfA4&google_cver=1&ssp=medianet&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 747
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816702837397404000V10 HTTP 302
  • https://contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
Request Chain 749
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1 HTTP 302
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Request Chain 750
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dcon%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ovsid%3D%24UID HTTP 302
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=1b1107c35722122d&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dcon%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ovsid%3D%24UID HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841522816702837397404000V10&ovsid=AAAGdc-Aay3uBQN1cTHvAAAAAAA&expiration=1638755084&is_secure=true
Request Chain 751
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dmma%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ovsid%3D%5BMM_UUID%5D HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841522816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
Request Chain 752
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ovsid%3D_wfivefivec_ HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841522816702837397404000V10&ovsid=IoqlAHf41MTGzX5
Request Chain 753
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dzem%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ovsid%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=trvwnD5JptIAO-iXxRvu&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLUOJ3HO3SEGVFHA5CJIFHS22KYPBJHM5JGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRYGY4DIMJVGIZDQMJWG4YDEOBTG4ZTSNZUGA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGI4DGNZTHE3TIMBUGAYDAVRRGA HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLUOJ3HO3SEGVFHA5CJIFHS22KYPBJHM5JGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRYGY4DIMJVGIZDQMJWG4YDEOBTG4ZTSNZUGA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGI4DGNZTHE3TIMBUGAYDAVRRGA HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&ovsid=trvwnD5JptIAO-iXxRvu&refUrl=&type=zem&vid=86686841522816702837397404000V10&vsid=2816702837397404000V10
Request Chain 754
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Damb%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ovsid%3D%23USER_ID%23 HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841522816702837397404000V10&ovsid=7864110075816986117
Request Chain 760
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Request Chain 761
  • https://x.bidswitch.net/sync?ssp=the33across&us_privacy= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=93&user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21} HTTP 302
  • https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3D10%26external_user_id%3De844459d-39b0-402c-bf5a-7640e7a8c718 HTTP 302
  • https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718 HTTP 301
  • https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
Request Chain 762
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1638668683884.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dg%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D1%2526external_user_id%253D%255BMM_UUID%255D HTTP 302
  • https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Request Chain 763
  • https://ups.analytics.yahoo.com/ups/58350/sync?redir=true HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-06Ws90BE2uHYKFpbS0U.YFj1h.ATYhTM~A HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-06Ws90BE2uHYKFpbS0U.YFj1h.ATYhTM%7EA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 764
  • https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy= HTTP 302
  • https://33across-match.dotomi.com/match/bounce/current?DotomiTest=21ae8a656132122e&is_secure=true&networkId=78390&version=1&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps?xi=64&xu=AAAGdipzeeAG0AMRLIkoAAAAAAA&expiration=1638755084&is_secure=true&us_privacy= HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdipzeeAG0AMRLIkoAAAAAAA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 765
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1641260684%26external_user_id%3D7de5ca57-c954-4db1-bc90-ae26323dfac5 HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641260684&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5
Request Chain 782
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=c37cf53a-b31d-44ca-8259-d06cf5f5798d-tuct8a59f0c&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Request Chain 783
  • https://gocm.c.appier.net/pubmatic HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sSE8PgZVA8-yk7I4jRmsYQ
Request Chain 784
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent= HTTP 307
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Request Chain 785
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=a5677e3a-ded4-44c9-b5be-254f6a67d483&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Request Chain 787
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
Request Chain 788
  • https://pixel.onaudience.com/?partner=214&mapped=F458BC18-DC0D-48F9-98CC-615D57A2C396 HTTP 302
  • https://spl.zeotap.com/?zdid=1332&zcluid=27ef478db6b78c1a HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=520b764d-9055-4078-6f4a-c901c72165e5&reqId=822c8510-c947-4cac-5c97-fb0cc182e2fc&zcluid=27ef478db6b78c1a&zdid=1332 HTTP 302
  • https://mwzeom.zeotap.com/mw?google_gid=CAESEESUQTi3LVAY1_mv94JUZfM&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=520b764d-9055-4078-6f4a-c901c72165e5&reqId=822c8510-c947-4cac-5c97-fb0cc182e2fc&zcluid=27ef478db6b78c1a&zdid=1332
Request Chain 789
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr= HTTP 302
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=&fbounce=1
Request Chain 791
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:F458BC18-DC0D-48F9-98CC-615D57A2C396 HTTP 302
  • https://io.narrative.io/?io.narrative.guid.v2=ebedc561-556c-11ec-8734-065a0b8073db&companyId=673&id=pubmatic_id:F458BC18-DC0D-48F9-98CC-615D57A2C396
Request Chain 792
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4764934967218434204
Request Chain 793
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8987304192775495297
Request Chain 794
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:1dac68b7-b69a-4192-845a-8b17d560cf53&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 796
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
Request Chain 797
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Request Chain 798
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
Request Chain 799
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
Request Chain 801
  • https://c1.adform.net/serving/cookie/match?party=29 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=4764934967218434204&expiration=1639878284
Request Chain 805
  • https://us.creativecdn.com/cm-notify?pi=districtm HTTP 302
  • https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
Request Chain 806
  • https://sync.srv.stackadapt.com/sync?nid=132 HTTP 302
  • https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
Request Chain 807
  • https://p.rfihub.com/cm?pub=36496&in=1 HTTP 302
  • https://dmx.districtm.io/s/10056/979321821552651232
Request Chain 808
  • https://x.bidswitch.net/sync?ssp=districtm&user_id=21qVcYtoROmI7iVfVngDipq6SdP HTTP 302
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=e844459d-39b0-402c-bf5a-7640e7a8c718&ssp=districtm&gdpr=&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10597814350218064749&gdpr=&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26ssp%3Ddistrictm%26gdpr_consent%3D%26gdpr%3D HTTP 302
  • https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=a507803e-3812-41e4-80b2-78e5739cd1db&ssp=districtm&gdpr_consent=&gdpr= HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=[mPlatform_cookie_ID]&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent= HTTP 302
  • https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=205010403991001836584&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10597814350218064749&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
Request Chain 809
  • https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74 HTTP 302
  • https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Request Chain 810
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
Request Chain 811
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Request Chain 812
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
Request Chain 813
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
Request Chain 816
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_dsp_id=131&cm_user_id=YawZhBbaf-sLobsSgmffIQAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301220038102
Request Chain 817
  • https://sync.extend.tv/r.gif?exchange=index HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=d513aecf-8a99-446b-bf4a-ab692c053dae
Request Chain 819
  • https://us.creativecdn.com/cm-notify?pi=districtm HTTP 302
  • https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
Request Chain 820
  • https://sync.srv.stackadapt.com/sync?nid=132 HTTP 302
  • https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
Request Chain 821
  • https://p.rfihub.com/cm?pub=36496&in=1 HTTP 302
  • https://dmx.districtm.io/s/10056/979321821552651232
Request Chain 822
  • https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74 HTTP 302
  • https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Request Chain 823
  • https://x.bidswitch.net/sync?ssp=districtm&user_id=21qVcdesu5KLspVqdWBe9wYqfv7 HTTP 302
  • https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=districtm&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=districtm&gdpr=0&user_id=qeRHCK7sHl6y4h4K_uMLWqmzE1my5hEP_eWvh-W- HTTP 302
  • https://dmx.districtm.io/s/10009/e844459d-39b0-402c-bf5a-7640e7a8c718
Request Chain 829
  • https://um2.eqads.com/um/cs HTTP 302
  • https://um2.eqads.com/um/cs&eq_cc=1
Request Chain 843
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668682700&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834 HTTP 302
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668682700&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=e11dd817-d7d5-4019-812c-bacbd3e1e5fa&a.is_yahoo=3&redirect_y=dHM9MTYzODY2ODY4NDg0Ni4yNjQ0MDQ6dXVpZD0iODY4MzA4NTQ5NDI2OTIyODg4NF9fVElNRV9fMjAyMS0xMi0wNCsxNyUzQTQ0JTNBMzgiOmFwaWQ9VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ6cmVxdWVzdF9pZD1lMTFkZDgxNy1kN2Q1LTQwMTktODEyYy1iYWNiZDNlMWU1ZmE=
Request Chain 847
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=1&xu=KWSL0RE8-3-ILJG HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL0RE8-3-ILJG&ts=1638668685&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 927
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668688908&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834 HTTP 302
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668688908&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=981f9615-2e85-4c70-8d4c-a2a348e72e2f&a.is_yahoo=3&redirect_y=dHM9MTYzODY2ODY4OTY5Mi4xMzcyMDc6dXVpZD0iODY4MzA4NTQ5NDI2OTIyODg4NF9fVElNRV9fMjAyMS0xMi0wNCsxNyUzQTQ0JTNBMzgiOmFwaWQ9VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ6bWlncmF0ZWQyeT0iMSI6cmVxdWVzdF9pZD05ODFmOTYxNS0yZTg1LTRjNzAtOGQ0Yy1hMmEzNDhlNzJlMmY=

931 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/ 		71 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8bc199ab83f0a2e461c4392fe72c773236576ce97f2db2228bb360ba58c483e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-type
text/html; charset=UTF-8
content-security-policy
upgrade-insecure-requests;
x-frame-options
SAMEORIGIN
cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
expires
0
last-modified
Tue, 16 Nov 2021 14:27:18 GMT
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6b8997135ee17156-YUL
content-encoding
br
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ff420b26b8a33e1bcae39c4d165c2cc259681bbb7b32565dbd7644c1d84cbfa8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:44:35 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:44:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:44:35 GMT
bootstrap.min.css
www.bleepstatic.com/js/redesign/bootstrap/css/ 		119 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bootstrap/css/bootstrap.min.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4490
last-modified
Wed, 13 Feb 2019 14:22:49 GMT
server
cloudflare
etag
W/"624975547"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1f7KZpmckFgvMhGBtHeO5OHFTh%2F%2FwDtbBEAFlJbrF%2FfeVS7KAI3tNrLrzrmGSrGoeEk6%2BYRMpGNRWJiXsSmfs4BX%2Bat0j7%2Bt2Mnlpg8hFuV6S%2FLDpgBPvV3wOfCfaovKWz%2F4tu8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b8997159faa4bd7-YUL
expires
Fri, 23 Jul 2021 03:04:43 GMT
main.css
www.bleepstatic.com/css/redesign/ 		52 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b37f3d8aa5e1f298bf71477c945f576745020ce44f048ec67e19a93cd285372

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4489
cf-polished
origSize=62676
last-modified
Tue, 27 Apr 2021 20:09:53 GMT
server
cloudflare
etag
W/"2761713618"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DrNLpSBs0JgIxeclErTh%2FjoVFhDcXPCdAcx0tr5fw61UJP8ho4IomPMvasJNAJ2bHYBx1YwqspdqPJDvsS96f8i6mTknJmTPlVrUy8Mgu2fIRt3UFFuTw99Lfa7ahkhoXBOe4BE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 23 Jul 2021 03:04:42 GMT
cache-control
max-age=3024000
cf-ray
6b8997159fad4bd7-YUL
cf-bgj
minify
home.css
www.bleepstatic.com/css/redesign/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/home.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1496
cf-polished
origSize=15024
last-modified
Sat, 21 Nov 2020 17:53:40 GMT
server
cloudflare
etag
W/"2807382579"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JgfMnywfNnlFXJ%2B7G4KhKR4Ax0UkTGgi3KZ808HR4z1%2Fp9luZtHbRPsPCOFYv%2FMQ0LZbbcSKvLqbJOzeHsc9FyXlh5985By0C%2FM9KU18Ukb0Xe8f7aDG873jSYJZxYZ2lMS3ytc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:55 GMT
cache-control
max-age=3024000
cf-ray
6b8997159faf4bd7-YUL
cf-bgj
minify
news.css
www.bleepstatic.com/css/redesign/ 		27 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/news.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4901b094a91ea6d5aba73774bb9803fdca22599cfca597ef81249225b5ed01b4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
219
cf-polished
origSize=33102
last-modified
Tue, 24 Aug 2021 22:50:05 GMT
server
cloudflare
etag
W/"57477024"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IYlOjiiyCpcp11qrt9I%2BgrV%2FNYskO8BPkyb01NlE%2B2i28YdbgZtN5rUgHQO1QaBe7U8%2BgQEz7DOwE1SWRrt7riCG9Nr2DBnhzEbU2Vj2D7mZ%2F6l9TUO62wFuEZiKQbLfODgvwuQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Tue, 28 Sep 2021 22:50:37 GMT
cache-control
max-age=3024000
cf-ray
6b8997159fb04bd7-YUL
cf-bgj
minify
jquery-3.5.1.min.js
www.bleepstatic.com/js/redesign/ 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/jquery-3.5.1.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4041
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
cloudflare
etag
W/"1177690299"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wv5Tdc27%2FiQZDKeK94stasiG45AYrhACEt%2BwivWSKUBKsAGSB4%2Bd4uPf2hgU%2BB0DvwoDviGeIFZ9F%2BGJBWh2fHoplG2F06XR3JDu0NjCcHlduSz4TV73VlS4CJFWMrXSavLqz4U%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b8997159fb24bd7-YUL
expires
Fri, 19 Nov 2021 13:03:27 GMT
jquery-migrate-1.4.1.min.js
www.bleepstatic.com/js/redesign/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/jquery-migrate-1.4.1.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4041
last-modified
Fri, 20 May 2016 01:26:30 GMT
server
cloudflare
etag
W/"2177127834"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k7witn7pZW9qLMEoSC6bqaamQNOBQPO6fp%2BdiZ0GXxqs63NfH%2FC%2BqTc3Li4djVZIMVfzlHsRfJCQIPx31DkGphnPiilaBUTWFPE5pUN6uB0XCwLsj1dRd1KUoe6OACQk9ohmAnU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b8997159fb34bd7-YUL
expires
Fri, 28 May 2021 10:23:56 GMT
news.js
www.bleepstatic.com/js/redesign/ 		183 B
468 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/news.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
219
cf-polished
origSize=247
last-modified
Wed, 16 Dec 2015 15:41:46 GMT
server
cloudflare
etag
W/"4218930423"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ge56NOQlkMxCvcrvcNzLA5kA6LOZid1nwFxEc0fcvAM2yDKe4ezT%2Fx11pi%2FlGHsJKYTVl5Bgk0UKNr%2FZyo8vatJxyVpUPRFsHEYD75NbmR4LBdwiMuPfuuaRbxdcpNLJo4KUyjI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:56 GMT
cache-control
max-age=3024000
cf-ray
6b89971628624bd7-YUL
cf-bgj
minify
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81B9) /
Resource Hash
97719c71e44494e537beba8d51c6bb268a34dcd867fdefc431229225ca734b46

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:35 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Dec 2021 21:35:27 GMT
Server
ECS (cha/81B9)
Age
1445
Etag
"50ec7e701ed018305368886c39cac301+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
29126
cls.css
a.pub.network/core/pubfig/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/cls.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d510e16e6e569e573980fd67a55221795d539fd56688ecaca8d284255e86ee6

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=kjwd8A==, md5=KtQsmezne0blpCqFIHo3UA==
date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3019
x-guploader-uploadid
ADPycdsGG-kwLk8pflxktB4g2ZiGP3PyE7F7zSFdjNQ8s7wtkp6PteyiJLUZI4QyxU7CCRKmELhzODpx-j_fSrDIgc-USHJyLw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
text/css
last-modified
Tue, 11 May 2021 20:31:48 GMT
server
cloudflare
etag
W/"2ad42c99ece77b46e5a42a85207a3750"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WzXsfFfKFPgKZdSI4Ts56hWCX76k86FLjaYvkzFPIduQDAAxUDZgNg9nQtqr6uJyK7Oci6660E0ZMtniQQ962VTl8cPySNlb94SB4M0FtynO%2Fgcy7BUXiqPdv1tgCw%2FONwZ528UyfDn1CIY%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1620765108454625
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
1752
cf-ray
6b8997159e4d713e-YUL
expires
Sun, 05 Dec 2021 01:54:16 GMT
pubfig.min.js
a.pub.network/bleepingcomputer-com/ 		118 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1da31085512b343f2de6f64bcdbeeb3bc50a54859a5fb7878c434fde47510405

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=jWjThw==, md5=/1OP2Hd7VLh8XOS8svIYHg==
date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
363023
x-guploader-uploadid
ADPycdssHcjj7qPZ9IeKXkXMpo_SxqZ3toJyQ8bpW6zirkN6SJ-pDiR5iMakGtCsuqn7yVjssp16CESBmyhwWRE3pic6tXUVgg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Wed, 24 Nov 2021 16:27:10 GMT
server
cloudflare
etag
W/"ff538fd8777b54b87c5ce4bcb2f2181e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yGVZjeWFlTz2y8jJj2cIo1Hqiy29nUesV6N5MDAN092BAlmfKmyHVN72w4LyEJOLNKMh0Lv8yrgKrkWnv9IFr5eObnqUyu1qqcoXYGvIay%2B7zruuiNbadjYXkdUQcmbyJ2OUL0o6OY1DAiI%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1637771230054431
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=1800
x-goog-stored-content-length
120881
cf-ray
6b8997162ef6713e-YUL
expires
Tue, 30 Nov 2021 20:55:12 GMT
js
www.googletagmanager.com/gtag/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3508fc61e7bce6b91542e3d167b537a94b8847b18254a90dc9d8d3956b79555
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36142
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 05 Dec 2021 01:44:35 GMT
logo.png
www.bleepstatic.com/images/site/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/logo.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1062648
cf-polished
origFmt=png, origSize=1882
content-disposition
inline; filename="logo.webp"
content-length
1152
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=quzHHmW808ukaYTHFmoLUwsbFZZaRNfEZwv%2F%2F0m%2BpixOdLsth80c7HvGGGZ5SIb0w2pI66%2FVA0QntewfXKxT9kXd51t9MXVmIJa%2B55RvpX%2F3QSPcs8Krgz1y%2FqVJMd4zrK3kUWk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 18:33:47 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971628634bd7-YUL
cf-bgj
imgq:85,h2pri
brandjs.js
www.gstatic.com/prose/
Redirect Chain
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
  • https://www.gstatic.com/prose/brandjs.js
14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/prose/brandjs.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:48:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75368
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5807
x-xss-protection
0
last-modified
Tue, 06 Apr 2021 15:14:29 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Sun, 05 Dec 2021 04:48:27 GMT

Redirect headers

date
Sun, 05 Dec 2021 01:18:42 GMT
x-content-type-options
nosniff
server
sffe
age
1553
content-type
text/html; charset=UTF-8
location
https://www.gstatic.com/prose/brandjs.js
cache-control
public, max-age=1800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
237
x-xss-protection
0
expires
Sun, 05 Dec 2021 01:48:42 GMT
Emotet.jpg
www.bleepstatic.com/content/hl-images/2020/07/28/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2020/07/28/Emotet.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8784352d3d9a95ec8bff3ede98a66f89f629d7fc68c9723897d6e27dbd47d06b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
362199
cf-polished
qual=85, origFmt=jpeg, origSize=85982
content-disposition
inline; filename="Emotet.webp"
content-length
46640
last-modified
Tue, 28 Jul 2020 18:39:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bZyGdRKMKT1eGRrtuh6V0Rr%2B28sZZ4ZwGRnkC4IfTYEG2YFKDoFC2aQHsJXTjoWs%2FM7iJ81ulXqJ2rGNIREHA3MwXHoSBvQjbJuXLC2we0P4FdNSct3M%2BojvVY0ZxpQaEvyHfVU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Thu, 30 Dec 2021 21:07:56 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971628644bd7-YUL
cf-bgj
imgq:85,h2pri
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		145 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2247a33d9ec387271839485ea86a7526c01242242c2aec936ed7d62ce792447d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52001
x-xss-protection
0
server
cafe
etag
12854501634624856980
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sun, 05 Dec 2021 01:44:35 GMT
Bleeping_Computer_CIR_Nov_2021-opt.gif
www.bleepstatic.com/images/comp/flashpoint/ 		367 KB
368 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/comp/flashpoint/Bleeping_Computer_CIR_Nov_2021-opt.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cdce68d55ff0acea805c6354fafdddf6cafc1b111a9ece1f891acf3e5a5dc6d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4490
cf-polished
status=not_needed
content-length
375851
last-modified
Tue, 02 Nov 2021 18:47:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vTaBHsULvM3poJdT05YA8a%2FERWA7X8qwosn7ViPomznHDjDwNohXFRc8iZOImHGxez0B%2Fmu8CIQwRYmfUFynPBkhb%2Fglr7DE2q91Mn2ePr99FqQinRAW1KWLFXNFYsBZLioDT64%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
access-control-allow-origin
*
expires
Thu, 02 Dec 2021 18:48:58 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971628654bd7-YUL
cf-bgj
imgq:85,h2pri
twitter.png
www.bleepstatic.com/images/site/login/ 		282 B
662 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/login/twitter.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
197097
cf-polished
origFmt=png, origSize=475
content-disposition
inline; filename="twitter.webp"
content-length
282
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EcT50Cxc7caG3Ka4McQK8tLlNzIzw8wGT9xQhPt6yq%2Fp5rT3j0zS4Hx2qsMxgG2iGIvQjT%2BCk8uLcSYEKhlsoHDBtESyAoGzOnvOAo5DdYc9VpBcb%2BWfuFuIp22CpaPed%2FmpDV0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 18:59:38 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971628674bd7-YUL
cf-bgj
imgq:85,h2pri
bootstrap.js
www.bleepstatic.com/js/redesign/bootstrap/js/ 		50 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bootstrap/js/bootstrap.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c13d034eaf2fa73680d0abdbe02ac23b73e3128b5c7f0ee7018eb7b3fbe84a72

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4485
cf-polished
origSize=75484
last-modified
Wed, 13 Feb 2019 14:22:49 GMT
server
cloudflare
etag
W/"984724076"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T4OS9RO5wCOj09n0z8c4I3pwwkTz318gDMTXzFjrUlvJ3hlDzz9ArziGih410wYXCIuW79vV0F8DCBRN7XvMqtL2mbLSklFJJYwbMSGC4TBCvSXbabupR6FyvbX4CMfQeaTupp0%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:56 GMT
cache-control
max-age=3024000
cf-ray
6b899716286a4bd7-YUL
cf-bgj
minify
blazy.min.js
www.bleepstatic.com/js/blazy/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/blazy/blazy.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4486
last-modified
Thu, 16 Aug 2018 21:06:19 GMT
server
cloudflare
etag
W/"753357888"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f%2B7tXpgbSy4deN278Fm32JYW1iw1aEOE%2F94w2me9FNSYmCxt4b3pk6iSWVvToh%2Bt2KDPOB%2BRuKHoqTEePc3CPP7j62sabjc5vpY4cQuIQy4PUR5MPVfRBAqUNf1DyX0Ky6XZmDI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b899715e8084bd7-YUL
expires
Fri, 28 May 2021 10:23:56 GMT
bleep.js
www.bleepstatic.com/js/redesign/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bleep.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4485
cf-polished
origSize=3600
last-modified
Mon, 01 Oct 2018 12:47:57 GMT
server
cloudflare
etag
W/"2696894447"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DE25alRIsE9MUIGs1ftMv4iXqOhrJRvAIPxUteeA4dCOulpSWbN9nUQ%2FwsqAk3kXPqqUCdfEA3HCOko2r6axcsvpDCaT3y05i6nkOoJL8Vayp0RPQV28lNzdoD4Z37adEc3ssEM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 23 Jul 2021 03:04:43 GMT
cache-control
max-age=3024000
cf-ray
6b899716286b4bd7-YUL
cf-bgj
minify
jquery.fancybox.js
www.bleepstatic.com/js/redesign/fancybox/ 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
219
cf-polished
origSize=48706
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
etag
W/"327140449"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d4XBu2xo5j2DASqIylSEBehGtkIQzqo%2FaaS4aLr7WsEHkNqEg%2BRBCE8QnxzdpiDZMiYu0NYtl5uufRrWRCZT%2B6oeE%2FgBYDukn3jtsNYOScIbZwJSk9hgLlaEfLK5EZJhBcW1xNs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:56 GMT
cache-control
max-age=3024000
cf-ray
6b899716286c4bd7-YUL
cf-bgj
minify
fixto.min.js
www.bleepstatic.com/js/fixto/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/fixto/fixto.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4041
last-modified
Sat, 13 Jun 2015 21:34:42 GMT
server
cloudflare
etag
W/"1740214911"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sxi73%2FuSWc8EYJ5%2F%2F0h8oV3eeJbma%2FHwZhn7kPYwENQgB7tsHJHC%2FMW7ee8D3nvQFoxJ7OYS9gZML%2BMOoIY%2FnGRZOdq1DlF3aqTQFs76hFJ1l2XdXMeYzUxhapYVgmyWb%2FhofAs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b899715e80b4bd7-YUL
expires
Fri, 23 Jul 2021 17:44:06 GMT
addthis_widget.js
s9.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s9.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
x-check-cacheable
YES
cache-control
public, max-age=600
date
Sun, 05 Dec 2021 01:44:35 GMT
x-host
s9.addthis.com
content-length
116325
v64f9daad31f64f81be21cbef6184a5e31634941392597
static.cloudflareinsights.com/beacon.min.js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bf0a170ae91f1bb8d0c94381a74ab8b85f938bf31bf18a9c8e3b835250d3be6

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
gzip
last-modified
Fri, 22 Oct 2021 22:23:12 GMT
server
cloudflare
etag
W/2021.10.0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
6b8997167d83713f-YUL
connatix.playspace.js
cds.connatix.com/p/140482/ Frame A266
Redirect Chain
  • https://cd.connatix.com/connatix.playspace.js
  • https://cds.connatix.com/p/140482/connatix.playspace.js
1 MB
242 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/140482/connatix.playspace.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
59d6a1ad252c9993eeb7899bbf9fe12b0942588987aaf144d0a11f20463f8d98

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
last-modified
Fri, 26 Nov 2021 12:04:32 GMT
age
739200
etag
"6a5c65576d6197257cddfa44d3776ec8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
246955

Redirect headers

location
https://cds.connatix.com/p/140482/connatix.playspace.js
date
Sun, 05 Dec 2021 01:44:35 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
server
Kestrel
accept-ranges
bytes
content-length
0
fab.js
ecdn.analysis.fi/static/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.analysis.fi/static/js/fab.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.63.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-63-107.ewr53.r.cloudfront.net
Software
nginx/1.18.0 /
Resource Hash
d8a34aeacc4054bd4e119e538c7eb4956421014f48a9b603d3f9314a7435b5a6

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:26:19 GMT
content-encoding
gzip
last-modified
Sat, 04 Dec 2021 21:35:45 GMT
server
nginx/1.18.0
age
1096
etag
W/"61abdf31-1090"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
x-amz-cf-pop
EWR53-C1
x-amz-cf-id
7cMkf30kb6VUgcbsFnb5BzJRK8BzKNCmKh36JmN1G5AI3p2O2bJPGQ==
via
1.1 5ec6b37107376867228d2ed46a794603.cloudfront.net (CloudFront)
expires
Sun, 05 Dec 2021 02:26:19 GMT
fi_client.js
ecdn.firstimpression.io/ 		347 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.firstimpression.io/fi_client.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-111.ewr50.r.cloudfront.net
Software
nginx/1.18.0 / PHP/7.3.23
Resource Hash
2af10b9c9dd4d6b4239687a27938947a38179a67c80498d29069b23ee95d0c16
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:26:16 GMT
content-encoding
br
age
1099
x-powered-by
PHP/7.3.23
x-cache
Hit from cloudfront
x-xss-protection
0
access-control-allow-origin
*
last-modified
Sun, 05 Dec 2021 01:26:16 UTC
server
nginx/1.18.0
etag
W/"7b4ba2934e1b215444c085a62f57db18"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 00fd85d5c5d5bd788f272591be9ecbca.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
EWR50-C1
x-amz-cf-id
njgpFUKN-jmh4r_J7NxVdMSEx5LMhYVfoRr402sP4VCIP49yVP3fXw==
expires
Sun, 05 Dec 2021 02:26:16 GMT
login_bg.png
www.bleepstatic.com/images/site/ 		126 B
489 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/login_bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
196175
cf-polished
origFmt=png, origSize=187
content-disposition
inline; filename="login_bg.webp"
content-length
126
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WyBltdoYH3LCmp86bM5BpVhn4wAb9%2FcUJUbb%2FDXL5iTNeB2oli2kF3%2F9NF7YKZyfjkSo7vnJAcK8jsxO6X%2Fnpm%2BoVoCpZGwhn1Qxo1bf8mzBfwe0J7dkbI1k5gX9H99%2Bo0w8%2Fcw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 19:15:00 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899716286e4bd7-YUL
cf-bgj
imgq:85,h2pri
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 16:23:56 GMT
x-content-type-options
nosniff
age
379239
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 30 Nov 2022 16:23:56 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 01:28:42 GMT
x-content-type-options
nosniff
age
173753
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 03 Dec 2022 01:28:42 GMT
truncated
/ 		37 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
nav_bg.png
www.bleepstatic.com/images/site/ 		72 B
457 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/nav_bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191529
cf-polished
origFmt=png, origSize=83
content-disposition
inline; filename="nav_bg.webp"
content-length
72
last-modified
Sat, 04 Mar 2017 07:57:02 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yrwxCXO97d5APoJ83omsxY%2Bz7QMjo2rlHmLzNWme7NyEVLM3%2FBwN%2FyrVASufgw4pQsdPLtVdYtaa4%2BvvyR1I8%2BUcXJfll6lO0AXYoKdOZm4nWlk%2FommhBCel2ydiTW%2B7u8UItO0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 20:32:26 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899716488f4bd7-YUL
cf-bgj
imgq:85,h2pri
20x20-printer.png
www.bleepstatic.com/images/site/ 		422 B
982 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/20x20-printer.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1064388
cf-polished
origFmt=png, origSize=824
content-disposition
inline; filename="20x20-printer.webp"
content-length
422
last-modified
Sat, 03 Oct 2015 03:18:32 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vG8ezdoadKMpim%2B3dVT4bEGPZXLrsRm3jTwFSEZcNk8ZO1doSekmN8CAi08kBXKkE88YFAz%2FcYubDUnW417hICkgYN4t%2FE%2BQGWunVX6z%2Fjd%2BmIdQdymZpGmHWbiEgbSaHJvp7CA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 18:04:47 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a14bd7-YUL
cf-bgj
imgq:85,h2pri
calendar.png
www.bleepstatic.com/images/site/ 		86 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/calendar.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
197097
cf-polished
origFmt=png, origSize=129
content-disposition
inline; filename="calendar.webp"
content-length
86
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EJlM0YRQmkvPKpTbPHGm9jYh5Pha7sfIy2zkuekQYluzPtp2KO3tY8i3IAVNhCPP4fr3QRuuHyExTUqzBjzxi%2FnRfWYaPhk3sG%2FPH8emG8X3Pl5qLUUI4hBXej1CQGavLyaeIr0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 18:59:38 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a24bd7-YUL
cf-bgj
imgq:85,h2pri
clock.png
www.bleepstatic.com/images/site/ 		252 B
674 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/clock.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9cdb6bfef8d4212d9bf634ca6724a28e85dfa69cd404e6f9d3760d70a7873949

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1065775
cf-polished
origFmt=png, origSize=1316
content-disposition
inline; filename="clock.webp"
content-length
252
last-modified
Fri, 29 May 2015 07:08:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UliU6jrzr9BZ54%2BcOYZJoxBOIYyJuT%2Bz7oF7cePIi2RPkbvzsTwtMbCN%2BWj9MfpFNdTmzSfuH2N8GwrBQAvP5fiVGXyy0jKezCL5TmKGnqybrHi5R1KnzhSVNJHewn2bOpmOpw4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 17:41:40 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a34bd7-YUL
cf-bgj
imgq:85,h2pri
comment-light.png
www.bleepstatic.com/images/site/ 		94 B
480 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/comment-light.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfac05f501d6d4d62e29fff1049569c3c2aa8732af8db3a36e8fa252f05f5861

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
193583
cf-polished
origFmt=png, origSize=1034
content-disposition
inline; filename="comment-light.webp"
content-length
94
last-modified
Fri, 29 May 2015 07:08:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=67zyXgc1AdJUo8fEbnpl%2Fa1QozkkpgBxIpKMcRbsaUpSVztOhlx54ZDCa6r4ecEZc568gjaI57F7fs2%2FkEIcSER%2FWZfzgmn9z0veQN%2Ff65u8ZqjsWCzOVNkd7xcr%2FHVqZaSzUpQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 19:58:12 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a44bd7-YUL
cf-bgj
imgq:85,h2pri
32x32-printer.png
www.bleepstatic.com/images/site/ 		256 B
646 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/32x32-printer.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191503
cf-polished
origFmt=png, origSize=618
content-disposition
inline; filename="32x32-printer.webp"
content-length
256
last-modified
Fri, 02 Oct 2015 21:57:19 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rGkwf6bWtnhn9nR%2F1FWgJl9jb5uxZ%2BqzZ%2BeANDBUM4SHGxQmlX6xCwNv764OsZ5c3%2FsvJs4k32V4oYRlu8jG%2BvLxf8AKUK5Fy7SDjBS6%2BndKel0YFGWaLjIv4K3zaJihnRwHGTE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 20:32:52 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a54bd7-YUL
cf-bgj
imgq:85,h2pri
21beb902b545b086a90ec39f1df36b94.jpg
www.bleepstatic.com/author/photos/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb845bc1998e818ffd1ebeacd695e0a60e479e5993e5f0053e34bff96b8d4c53

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1495
cf-polished
origSize=7617, status=webp_bigger
content-length
7551
last-modified
Mon, 26 Oct 2015 17:15:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SmQ80U2HkF9r8ekV3pUNo4Y377sk3J4mkfKEbZLLvQB0c%2B82stn9ZWY2S2qs%2F3RVtI23s59%2FW5gjeCd0Iy4qV0UVstny%2FgP%2Fel7LqMsNPWipBqwxTHDqdE%2BlItDpoodOKI8sYHM%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 23 May 2021 10:26:42 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a74bd7-YUL
cf-bgj
imgq:85,h2pri
h4-bg.png
www.bleepstatic.com/images/site/ 		38 B
565 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/h4-bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1496391
cf-polished
origFmt=png, origSize=72
content-disposition
inline; filename="h4-bg.webp"
content-length
38
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fyoicesyfg4UunArKzZquZEYPVpcTa7qS2HhXVXQhg8%2FvhXJtpVO9lw9M35Wowvu0k8qZV5bbnXlK4WCRDWf8glg5eybqm0ywYVX3uxb2xgQ%2BIW1Gv5VHNEfiM%2FNHOcPdAfqLjI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 17 Dec 2021 18:04:44 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a84bd7-YUL
cf-bgj
imgq:85,h2pri
news_email_icon.png
www.bleepstatic.com/images/site/ 		126 B
564 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/news_email_icon.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/home.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/home.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1065775
cf-polished
origFmt=png, origSize=1105
content-disposition
inline; filename="news_email_icon.webp"
content-length
126
last-modified
Fri, 29 May 2015 07:10:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J2kuzclI31xGWx3rnFtf9a1omUA5cTNOHpY6zTGZRa%2BKW6nen3q5ELJ89xCa%2F4G%2BRsflokl%2BRRC4S1Ofc%2FV0V%2F85K2UnLkxDlAWP6XsztMj%2FHT39CxRFRkKTiBsRk1rhYhSRWW0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 17:41:40 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971648a94bd7-YUL
cf-bgj
imgq:85,h2pri
news_footer_icon.png
www.bleepstatic.com/images/site/ 		110 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/news_footer_icon.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191674
cf-polished
origFmt=png, origSize=186
content-disposition
inline; filename="news_footer_icon.webp"
content-length
110
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h7ot1ytQXGkBor5oRaLbx8Q6%2BNlD40sFDk00ooV4WLbapt%2BLCc2drh0DdaKv4%2BJN3SJNwe%2Fr65CECnD5QzjIEoTQqVtj6oHRPf7rD9hjG9JwC5U3pqsmH96Q8lzNRBB14u1C8YA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 20:30:01 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b89971658ac4bd7-YUL
cf-bgj
imgq:85,h2pri
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 04:56:13 GMT
x-content-type-options
nosniff
age
334102
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 01 Dec 2022 04:56:13 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:09:49 GMT
x-content-type-options
nosniff
age
5686
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Mon, 05 Dec 2022 00:09:49 GMT
init
d.pub.network/v2/ 		62 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/v2/init?siteId=535&env=PROD
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
25d600a009c1aff75bc9f7a09634c9d0521f426dfb9a5543fbbe58bcee474bef

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
jquery.fancybox.css
www.bleepstatic.com/js/redesign/fancybox/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3587
cf-polished
origSize=4895
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
etag
W/"9108074"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1v8DQWbVKo%2FI7ta4ehRROd1HPoLkWafoMcfvBtrCJQow0bQI9Axujrtw5qz%2Fp77sFkNcQ0V5h91civZ8pCU28O3HA7JK0bUnAPU0qYHsTLEzNcBW0wTEvv5Y%2FzDx%2FvTUldGy16Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 19 Nov 2021 17:02:08 GMT
cache-control
max-age=3024000
cf-ray
6b89971749ed4bd7-YUL
cf-bgj
minify
font-awesome.css
www.bleepstatic.com/css/redesign/ 		22 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/font-awesome.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4490
cf-polished
origSize=26776
last-modified
Tue, 03 May 2016 04:39:29 GMT
server
cloudflare
etag
W/"1700274315"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LRFXJe49oa6VapnzM7l6lbSZjWdrzfUwQNXme7dYzQN18WGd6rMRH6QEuw4JA8kQwc0W%2BG0NQaEXK2jQ8vrNsaN3XK64sD7MIlW0sgv9rMf1LRGL7d3lP7zJj3%2B%2F9RMU%2FNafj0Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 19 Nov 2021 13:03:28 GMT
cache-control
max-age=3024000
cf-ray
6b89971749f04bd7-YUL
cf-bgj
minify
favicon.ico
ad.doubleclick.net/ 		1 KB
664 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.81.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s74-in-f6.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 14:23:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
40844
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
last-modified
Tue, 08 May 2012 13:08:06 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/x-icon
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 14:23:51 GMT
achoice.svg
widgets.outbrain.com/images/widgetIcons/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.190 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-190.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
last-modified
Sun, 28 Nov 2021 09:31:35 GMT
server
AkamaiNetStorage
etag
"9d26fa4e7238ed94f1d0d92afb453b3e:1638092476.569147"
access-control-allow-methods
GET,POST
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=2592000
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *
content-length
2735
expires
Tue, 04 Jan 2022 01:44:35 GMT
292x176_modem_router.jpg
www.bleepstatic.com/content/hl-images/2021/11/19/thumb/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2021/11/19/thumb/292x176_modem_router.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b4d031954748e7f374abdfec4a7c1e2f83f7fadf0542058010250c0024970d1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
160558
cf-polished
qual=85, origFmt=jpeg, origSize=30858
content-disposition
inline; filename="292x176_modem_router.webp"
content-length
5804
last-modified
Fri, 19 Nov 2021 13:35:17 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3HUZ4xy3f4vLGNq8TZDeJWbd%2FfsAaHGCnkf%2F2pH2UN1CVT5%2FVbMwKO4spsVv45mp5uz2NsTjwL2yijssXpSouAz3luS4eVg%2FoC4E8lkYmMz%2Bm%2Fu4LfzT59YKlsGrXNHcc%2BB744w%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sun, 02 Jan 2022 05:08:36 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b8997177a444bd7-YUL
cf-bgj
imgq:85,h2pri
292x176_Russia-VPN.jpg
www.bleepstatic.com/content/hl-images/2021/06/18/thumb/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2021/06/18/thumb/292x176_Russia-VPN.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8b7069299acb7cecdf2bd4f42505d2cd5e08783754ef2a79d30f1f886f38a75

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
74383
cf-polished
qual=85, origFmt=jpeg, origSize=38301
content-disposition
inline; filename="292x176_Russia-VPN.webp"
content-length
7714
last-modified
Fri, 18 Jun 2021 15:05:59 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MkDW%2Fe4TxFS3jGCxQz4yx5KA%2F8W2x039Q4%2FlAzmQP3nUqFcC5Egfq%2B7Aimch3%2FxDowGuHZol7BtBGXF%2FbmRTGO420QYhtxdrs3Ww6tBJ%2FxL61k3qjaPjY1b1bb5QfmysfJFaIQk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Mon, 03 Jan 2022 05:04:52 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b8997177a484bd7-YUL
cf-bgj
imgq:85,h2pri
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
4960
date
Sun, 05 Dec 2021 00:21:55 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sun, 05 Dec 2021 02:21:55 GMT
fontawesome-webfont.woff
www.bleepstatic.com/fonts/ 		64 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/font-awesome.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Request headers

Referer
https://www.bleepstatic.com/css/redesign/font-awesome.css
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2015 09:36:00 GMT
server
cloudflare
age
192
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qIcizQSw1rutKf8YiKZM9OLb4Nem%2Fqx%2FmR7lNafpTmLv4OtaFSQ7j8sm0gAuzJHsnBmEumskqFlnw%2B%2FlYcWkrgPk%2FJN%2BejdKbmUZ85akz%2FxmaQ2ujnePT9KCnv6ks1CN4mIJyl0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
*
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
6b899717dcf24bd1-YUL
content-length
65452
widget_iframe.21f942bb866c2823339b839747a0c50c.html
platform.twitter.com/widgets/ Frame 7CB4 		319 KB
103 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Fwww.bleepingcomputer.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/80E1) /
Resource Hash
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
187623
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:44:35 GMT
Etag
"8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified
Thu, 02 Dec 2021 21:34:18 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (cha/80E1)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105433
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/ 		273 KB
99 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
23bcba5e39f4c422df7d14309b7435de0a2251ff20ca1a415b95e1d34343b2dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100882
x-xss-protection
0
server
cafe
etag
878613394246885701
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Sun, 05 Dec 2021 01:44:35 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/ Frame B5C3 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 15:56:00 GMT
expires
Sat, 18 Dec 2021 15:56:00 GMT
content-type
text/html; charset=UTF-8
etag
6406113418471942685
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4879
x-xss-protection
0
age
35315
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-85.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 17:28:38 GMT
content-encoding
gzip
etag
W/"1827f116c73f319409b97f10b8a58ade"
last-modified
Fri, 26 Feb 2021 14:35:05 GMT
server
AmazonS3
age
29987
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 724c8c129f28bfce25c0430050f1ae72.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
x-amz-cf-id
6l77iak_hjqljnrYPlczbIHemujcmagq39zojexq0KSRs7jXfjs76Q==
pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
a.pub.network/core/pubfig/ 		324 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cabdf43589214ad0231af8ec71b0ba10b72b5541a6a3238ac1b2d58cdac68329

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=O4ulCw==, md5=7swA9tv3eGkRs/SVH+GPiQ==
date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
363166
x-guploader-uploadid
ADPycds2671R1HqE_dJsh6l6jQlEygYmB4Z4SC8lpRaKkPY8xYY6RfGZiE1D1qg7L9FutRAofNaxSwPbAVNhWeDTG42DwQ9DKw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Thu, 18 Nov 2021 17:40:06 GMT
server
cloudflare
etag
W/"eecc00f6dbf7786911b3f4951fe18f89"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B2R5AABYZ24Ci9jgKupormysLvzdch34d06QKCbzFBqV3e7ongArwwaq4EzXM4tlWJ3U7wHj0bxVD8TqfBbVDW4F1opkmrmn0OZUOJgkVT8d81OeD4PIn9pIPuokZ02cL2cfJrJIQlRDBkc%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1637257206820465
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
332222
cf-ray
6b89971829ca713e-YUL
expires
Tue, 30 Nov 2021 21:45:12 GMT
connatix.playspace.css
cds.connatix.com/p/140482/ 		96 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/140482/connatix.playspace.css
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
51ae4c5642051d85bcfb8ed5d7ce619a0fd7cd201723c823f7495a829eefaa72

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
br
last-modified
Fri, 26 Nov 2021 12:04:31 GMT
age
739200
etag
"8080ed2619ce4713545db8f29021c7e4"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
13367
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
3BDAE1FAB05E52F4
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11170
accept-ranges
bytes
content-length
948
x-amz-id-2
JQEtOEyiFCqCP1YLI1OIPGBGUg/WHgpDv22+z5rvn/G8szLTqEelRVwbxuu0H6mk2GphOf1hSec=
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/ 		2 KB
855 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
etag
-1659864586--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=20, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
678
300lo.json
m.addthis.com/live/red_lojson/ 		128 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=61ac1983d19af23e&bkl=0&bl=1&pdt=370&sid=61ac1983d19af23e&pub=ra-561517d2c7f964d6&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.bleepingcomputer.com&fp=news%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=computers%2Cwindows%2Clinux%2Cmac%2Csupport%2Ctech%20support%2Cspyware%2Cmalware%2Cvirus%2Csecurity%2CBotnet%2CEmotet%2CMalware%2CTrickBot%2CTrojan%2Cvirus%20removal%2Cmalware%20removal%2Ccomputer%20help%2Ctechnical%20support&colc=1638668675961&jsl=8193&uvs=61ac1983a9084e66000&skipb=1&callback=addthis.cbs.jsonp__441346162276300860
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e1402c0fb103864cc844f68be7e28378d9d19f0f80212e1c98b9c4cfebaf2bb4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:36 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
p3p
policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
content-length
128
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 9239 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame A5CB 		71 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

server
nginx/1.15.8
content-type
text/html
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
etag
W/"5f971164-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
x-check-cacheable
YES
date
Sun, 05 Dec 2021 01:44:36 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
spc_fi.php
cdn.firstimpression.io/delivery/ 		39 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.firstimpression.io/delivery/spc_fi.php?id=5971&url=%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&charset=UTF-8&ch=1&ref=www.bleepingcomputer.com&viewerId=null&referer=&_firid=29627758
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-111.ewr50.r.cloudfront.net
Software
nginx/1.18.0 / PHP/7.3.23
Resource Hash
3b2264196284aad7b0d1f1fea4a65609d8d460cc0d18de705d5e6cba14d588d1

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-amz-cf-pop
EWR50-C1
x-powered-by
PHP/7.3.23
x-cache
Miss from cloudfront
p3p
CP="CUR ADM OUR NOR STA NID"
pragma
no-cache
access-control-allow-origin
https://www.bleepingcomputer.com
server
nginx/1.18.0
vary
Accept-Encoding
content-type
application/json; charset=UTF-8
via
1.1 00fd85d5c5d5bd788f272591be9ecbca.cloudfront.net (CloudFront)
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-amz-cf-id
VFnKBCatYjkDpL5pcmGfJ1tLfbrUxyARCk3D4AzTqhkQW93d_cOdXg==
expires
0
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=231263131&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ul=en-us&de=UTF-8&dt=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=114535339&gjid=860325488&cid=335997328.1638668676&tid=UA-91740-1&_gid=1413561734.1638668676&_r=1&gtm=2ouc10&z=69724078
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
pandg-sdk.js
pghub.io/js/ 		14 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pghub.io/js/pandg-sdk.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.217 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
217.45.241.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
9cd1b5630bcc34ecc71dbcbdfe45ddb9ed3cb4c0464a2abeb76bcc490635e376

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:15:18 GMT
content-encoding
gzip
age
1758
x-guploader-uploadid
ADPycdsQlUYkgNHaj8E9QTsfUw5AkvG_hcc2BFC-zYsCGInWmnhYIDpjIh3Cdy8YupVrsjsMU0eD-ndK2Ostyib_SgJ3CGnMLA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3637
last-modified
Mon, 22 Nov 2021 21:22:46 GMT
server
UploadServer
etag
"9f5012774da47c70284c82ae0ce443d7"
vary
Accept-Encoding
x-goog-hash
crc32c=oAHW2w==, md5=n1ASd02kfHAoTIKuDORD1w==
x-goog-generation
1637616166247508
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=3600
x-goog-stored-content-length
3637
accept-ranges
bytes
content-type
application/javascript
gpt.js
www.googletagservices.com/tag/js/ 		79 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f3385adf33b15d77200af558761f6a92bbeeab7254fa981f16089d6ea81db1dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1063 / 428 of 1000 / last-modified: 1638572771"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26973
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sun, 05 Dec 2021 01:44:36 GMT
tag
btloader.com/
Redirect Chain
  • https://freestar-io.videoplayerhub.com/gallery.js
  • https://btloader.com/tag?h=freestar-io&upapi=true
114 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://btloader.com/tag?h=freestar-io&upapi=true
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
2606:4700:20::681a:78b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4c8d6c66cf7bb5cf29e1a2cda44dcbed9df8bd54fb633aa5a4afb9933b73156

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cf-ray
6b89971a79757145-YUL
date
Sun, 05 Dec 2021 01:44:36 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1572
etag
W/"8d0de24faa294ec738a65b9be8e61766"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FfxXSNmfBe6tNJJuAIz4zDH4PX3qG4jnH8YP3ohBHd4sXwXzpPiwQn5nALQKemF%2FfH0rbBGlPn9trBiZIngesDsrCXvtNxRoSytqPddHgZxjyY8uatSx1bRzjdHneaucyiuSdGaZVa356Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=1800, must-revalidate
content-encoding
br

Redirect headers

date
Sun, 05 Dec 2021 01:44:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fh7RnmExDyVYcz7VfhsxlZq8OgjA9k16Wb3qHksElK3V%2BTtIipAM8cToYwpln9gLRw8rDkikuflWgtXMqtFwc5TcUmlbzZc0MyQX9j3t0GH8QyrszuOy54Q0ZgHSoWjsTefOCeH8%2FsaOnA7DbjAvYYYb3Ac8zgPXhbKLIA%3D%3D"}],"group":"cf-nel","max_age":604800}
location
https://btloader.com/tag?h=freestar-io&upapi=true
cache-control
max-age=3600
cf-ray
6b899719fcf84bca-YUL
expires
Sun, 05 Dec 2021 02:44:36 GMT
184310-82987131453484.js
js-sec.indexww.com/ht/p/ 		0
453 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/ht/p/184310-82987131453484.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:36 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Dec 2021 00:51:34 GMT
Server
Apache
ETag
"da0359-0-5d25b8ab0133d"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=577
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
20
Expires
Sun, 05 Dec 2021 01:54:13 GMT
prebid-analytics-4.42.7.js
a.pub.network/core/ 		458 KB
136 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-analytics-4.42.7.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
844d16730113c50876b1ea84b4ba3a56a4c0f115d04b8a25da0d558f1d799b00

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Chz8kg==, md5=qHN8a/kkUDZkU6QAridSuQ==
date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17562
x-guploader-uploadid
ADPycdvLZcWREBLMwRs5zTGWxs-F8hHrhY7yECBFlUWEHBfjoutzLO5ETYIZ9mHbRnn_ccSUQokT93H_L2vsZDnpgZJ8D9Qwvg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
content-type
text/html
last-modified
Wed, 03 Nov 2021 15:36:10 GMT
server
cloudflare
etag
W/"a8737c6bf92450366453a400ae2752b9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jdV9WPRBtUmsX4kDIOJzwM%2F5nNYMqm%2B6pmMIixaGGw5uPty0YYQin2BWXVhhYqb9SjwUNmvTZLqJdaDr5vtrc3mkqqCPHr%2FjDDa6LcToJr9s6VcmcbAw7%2BltHVG%2BJEnByvOoDirwgvrMcJg%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1635953770715042
access-control-expose-headers
*
cache-control
private, max-age=86400
x-goog-stored-content-length
469259
cf-ray
6b899719cbfc713e-YUL
expires
Sun, 04 Dec 2022 20:51:54 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638668676124&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638668676124&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2...
0
223 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638668676124&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
13.225.214.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-85.ewr50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
via
1.1 724c8c129f28bfce25c0430050f1ae72.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
etag
W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-amz-cf-id
UX00Z90ybtLe-X0qtC9iGwRX4CcXY-IdWcnO0-Zl_yoT8GBTVcYJ_g==
x-cache
Miss from cloudfront

Redirect headers

date
Sun, 05 Dec 2021 01:44:36 GMT
via
1.1 724c8c129f28bfce25c0430050f1ae72.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
vary
Accept
x-cache
Miss from cloudfront
content-type
text/plain; charset=utf-8
location
https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638668676124&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9=
content-length
336
x-amz-cf-id
WI3gQiapTRTAtt9d5Hh7y5AJr0AVMF-ifBgHvnMBI5fFfPXDo2nVUw==
story
capi.connatix.com/core/ Frame A266 		8 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/story?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
28253cd6734e65790bf90144f11a41c620c76d36437af4bce727566e1ac59dc7

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:35 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
7852
content-type
multipart/form-data
cookie.js
partner.googleadservices.com/gampad/ 		224 B
654 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=www.bleepingcomputer.com&callback=_gfp_s_&client=ca-pub-0920899300397823
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
94883a3fdd8403e398bbf227bf669e0cc041256c80434070d356f41c743b35dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
210
x-xss-protection
0
integrator.js
adservice.google.ca/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:807::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 9809 		121 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
849da4f976c9b84f358f42858d02c3464840a73f963ce4110006a423359fed7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Sun, 05 Dec 2021 01:44:36 GMT
server
cafe
content-length
25369
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sun, 05 Dec 2021 01:44:36 GMT
cache-control
private
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/ 		263 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Sun, 05 Dec 2021 01:44:36 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77651
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tn=HEADER&ign=false&pw=1600&ph=1200&x=0&y=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:36 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame E17D 		238 KB
61 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1637072838&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675833&bpp=1&bdt=444&idt=353&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=3065587345819&frm=20&pv=1&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=363
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e7ae488440135f77c09eb0d8cbb5164fbbf7c26c725e55c7298aa866749c915d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Sun, 05 Dec 2021 01:44:36 GMT
server
cafe
content-length
62068
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sun, 05 Dec 2021 01:44:36 GMT
cache-control
private
settings
syndication.twitter.com/ Frame 7CB4 		233 B
448 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=4dc41c59a4b54834076ebfc3a17b36e5148dc946
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Fwww.bleepingcomputer.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.8 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
2816082c025f64540b613fde3096d814ae21ac75279461ec1d6bcb5c07099fdd
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-response-time
7
date
Sun, 05 Dec 2021 01:44:35 GMT
content-encoding
gzip
last-modified
Sun, 05 Dec 2021 01:44:36 GMT
server
tsa_b
vary
Origin
strict-transport-security
max-age=631138519
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
528f450bba4fb31a3de58ff7ff236742065a5b066f29e33d0cd1d5725236bd97
content-length
167
pubads_impl_2021113001.js
securepubads.g.doubleclick.net/gpt/ 		348 KB
118 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021113001.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
sffe /
Resource Hash
465b31f84196ddfdd21c859a1460c95d70093d91e3ae5ce5c688c398b9dc20f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
119680
x-xss-protection
0
last-modified
Tue, 30 Nov 2021 13:53:22 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sun, 05 Dec 2021 01:44:36 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		213 B
761 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bleepingcomputer.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
3fef19e536824cf94f0a91aa3c591c5cce3a2324b0cb39b2a848ec4ea8ff642c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
125
x-xss-protection
0
expires
Sun, 05 Dec 2021 01:44:36 GMT
sr
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/sr?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		79 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
sffe /
Resource Hash
f3385adf33b15d77200af558761f6a92bbeeab7254fa981f16089d6ea81db1dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1063 / 470 of 1000 / last-modified: 1638572771"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26973
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sun, 05 Dec 2021 01:44:36 GMT
e479d936-f266-4695-b31e-4cbbd2412beb.bin
vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ Frame A266 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/e479d936-f266-4695-b31e-4cbbd2412beb.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
eb2c939431e6250150a8cde81a5203d320e4e83df92c11a11e90b16074581e0e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
last-modified
Sun, 05 Dec 2021 01:29:21 GMT
age
868
etag
"de91140eeb3c57cdfe88ac582e1382ab"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
829
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame A266 		374 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b630bfefb18b047f36806ca3d09555730a686f944adedef8ef6fabc3751b58f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
126291
x-xss-protection
0
expires
Sun, 05 Dec 2021 01:44:36 GMT
1.png
img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/1.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
age
3183060
etag
"o7hSHwAUmCBIixIgiGzuW02nJNU8oGEvPnjWp++AQj4"
access-control-max-age
86400
fastly-io-info
ifsz=11996 idim=794x206 ifmt=png ofsz=9784 odim=794x206 ofmt=png
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/png
content-length
9610
cks
cks.connatix.com/
Redirect Chain
  • https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d17%26ev%3dcee0a083e7aa41ee905839ad8069ffb9%26pname%3dIndex%26uid%3d
  • https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3Dcee0a083e7aa41ee905839ad8069ffb9%26pname%3DIndex%26uid%3D&s=190549&C=1
  • https://cks.connatix.com/cks?pid=17&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=Index&uid=YawZhBbaf-sLobsSgmffIQAA%26075
138 B
172 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=17&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=Index&uid=YawZhBbaf-sLobsSgmffIQAA%26075
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3400bc6028f6d330d201f515f120247f9f825186ccc98d48fbf035a0f874c184

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
138
retry-after
0

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:36 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://cks.connatix.com/cks?pid=17&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=Index&uid=YawZhBbaf-sLobsSgmffIQAA%26075
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
314
Expires
Sun, 05 Dec 2021 01:44:36 GMT
cks
cks.connatix.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gapzaid&ttd_tpi=1
  • https://cks.connatix.com/cks?pid=19&uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttl=1641260676
146 B
180 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=19&uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttl=1641260676
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6ab7fe4973bf2b22f36a0225e4bdf579916b2178399ef4976e940fb949d9133a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
146
retry-after
0

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:36 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cks.connatix.com/cks?pid=19&uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttl=1641260676
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
213
cks
cks.connatix.com/
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d6%26ev%3dcee0a083e7aa41ee905839ad8069ffb9%26pname%3dAppNexus%26uid%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fcks.connatix.com%252fcks%253fpid%253d6%2526ev%253dcee0a083e7aa41ee905839ad8069ffb9%2526pname%253dAppNexus%2526uid%253d%2524UID
  • https://cks.connatix.com/cks?pid=6&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=AppNexus&uid=8987304192775495297
128 B
254 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=6&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=AppNexus&uid=8987304192775495297
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3542a358999ee2612135951c3e43e1ee9d928c8fdd9cc4f05cdea754e1c8bd4a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
128
retry-after
0

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:36 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
ddedddb2-6f36-405b-ae7e-e4b8185da706
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cks.connatix.com/cks?pid=6&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=AppNexus&uid=8987304192775495297
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.html
eus.rubiconproject.com/ Frame CFD6
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:44:36 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Date
Sun, 05 Dec 2021 01:44:36 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
userSync.js
ads.pubmatic.com/AdServer/js/ Frame A266 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/userSync.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:14 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300709-1af3-5c4c7cca9e573"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
public, max-age=101446
accept-ranges
bytes
content-type
text/javascript
content-length
2267
expires
Mon, 06 Dec 2021 05:55:22 GMT
us
capi.connatix.com/core/ Frame A266
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=7cf4c6c4-b915-4cbd-83cc-28c0f662a829&ph=51e220cb-8c97-4a65-b047-91c933b79b78&&r=%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20https%3A%2...
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=7cf4c6c4-b915-4cbd-83cc-28c0f662a829&ph=51e220cb-8c97-4a65-b047-91c933b79b78&&r=%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20https...
  • https://capi.connatix.com/core/us?DemandPartner=8&UserId=cee0a083e7aa41ee905839ad8069ffb9&DemandPartnerUserId=8645db9c-e843-09c1-3274-4da3d40f88b0
0
156 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/core/us?DemandPartner=8&UserId=cee0a083e7aa41ee905839ad8069ffb9&DemandPartnerUserId=8645db9c-e843-09c1-3274-4da3d40f88b0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0

Redirect headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://capi.connatix.com/core/us?DemandPartner=8&UserId=cee0a083e7aa41ee905839ad8069ffb9&DemandPartnerUserId=8645db9c-e843-09c1-3274-4da3d40f88b0
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
us
capi.connatix.com/core/ Frame A266
Redirect Chain
  • https://sync.technoratimedia.com/services?srv=cs&pid=70&uid=cee0a083e7aa41ee905839ad8069ffb9&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d26%26ev%3dcee0a083e7aa41ee905839ad8069ffb9%26pname%3dSyn...
  • https://cks.connatix.com/cks?pid=26&ev=cee0a083e7aa41ee905839ad8069ffb9&pname=Synacor&uid=A44A121B6711404BB5C1FC98E5E2423F&direct=1
  • https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=A44A121B6711404BB5C1FC98E5E2423F&UserId=
0
156 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=A44A121B6711404BB5C1FC98E5E2423F&UserId=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0

Redirect headers

date
Sun, 05 Dec 2021 01:44:36 GMT
location
https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=A44A121B6711404BB5C1FC98E5E2423F&UserId=
access-control-max-age
86400
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
content-length
0
retry-after
0
48.008759e9efe1c1b693dd.js
s7.addthis.com/static/ 		281 B
486 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-119"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Sun, 05 Dec 2021 01:44:36 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
246
shares-post.json
api-public.addthis.com/url/serviceapi/ 		2 B
321 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-type
text/plain

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
surrogate-key
sFbt=https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
last-modified
Sun, 05 Dec 2021 01:00:00 GMT
server
nginx/1.15.8
date
Sun, 05 Dec 2021 01:44:36 GMT
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials
true
content-length
2
info.json
www.reddit.com/api/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&jsonp=_ate.cbs.rcb_cl7i0
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
edadd7b5710b054063f62ed5db4860a731b810f44202013af0d0114ba3c6c911
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-ratelimit-used
2
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
*
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
accept-encoding
content-length
1842
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
x-clacks-overhead
GNU Terry Pratchett
server
snooserv
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:44:36 GMT
x-ratelimit-remaining
298
content-type
application/javascript; charset=UTF-8
via
1.1 varnish
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-ratelimit-reset
324
accept-ranges
bytes
expires
-1
info.json
www.reddit.com/api/ 		144 B
694 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&jsonp=_ate.cbs.rcb_62z30
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
3dd0cfa8ac83f0a57908bb74e7cf30a7e6209bc2dfcc20a5e2dc7c5d86d16d54
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-ratelimit-used
1
via
1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-length
144
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
x-clacks-overhead
GNU Terry Pratchett
server
snooserv
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:44:36 GMT
x-ratelimit-remaining
299
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-ratelimit-reset
324
accept-ranges
bytes
expires
-1
px.gif
ad-delivery.net/ 		43 B
940 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.27793439310406476
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
date
Sun, 05 Dec 2021 01:44:36 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
273
x-guploader-uploadid
ADPycdupfa7KCtOe0TVtQ1XEXjEqBcYS55h5xltmciWkwyT05QVbX3hl2G6BY1wwXXVxP-9l4WeFTPgHVnUrgCoq0nDtipi3Jg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
5
x-goog-stored-content-encoding
identity
content-type
image/gif
content-length
43
last-modified
Wed, 05 May 2021 19:25:32 GMT
server
cloudflare
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VglkPNz2o7HLp%2BAFvpX9%2FqeeSJot29mui%2BBMuOx5epTNgkPe%2BT1jqTcx4nQZnDlUhdsDD3dTT2%2F7ikYH%2FxlQhmD6QEfQYkyxH89A5PGfSsmYLHawbNVa7QJdfsWXAfZ0AL5HvuVWOhE1RkCEag%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1620242732037093
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
43
accept-ranges
bytes
cf-ray
6b89971bfbb0ecf2-YUL
expires
Sun, 05 Dec 2021 02:11:30 GMT
ao
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ao?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:35 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
g
capi.connatix.com/rtb/ Frame A266 		766 B
1022 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/rtb/g?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
16b76921dd3277b08abb6df1637115bab33293b31db9547459b8e5bb9f515ed6

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:35 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
766
content-type
multipart/form-data
514171
vid.springserve.com/vast/ Frame A266 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
af3fb4daf87b0fbb111931048be4b0672173d52619937a69dd00f46e9de24190

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:36 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-encoding
gzip
content-type
application/xml;charset=UTF-8
ps
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ps?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
mq
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/mq?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		8 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
080d3929d4c6f0ca45ddef3f56e45b6372b9b00b03ade7fc36c959f94ef8baff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
age
881
etag
"GICP79pa/FQ/5snpiMTH+uDruqrSZtYgD0cxofMRTR4"
access-control-max-age
86400
fastly-io-info
ifsz=44391 idim=1600x900 ifmt=jpeg ofsz=8220 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7114
9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		8 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3b7c7d6643053e78c799bbf5dbadb05e66477a788da19dba5789bb2e46f1ee71

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
age
881
etag
"+XNcC/j52nCPkKz7qa5JIShnW9QN+S3lmkccfyLGLrc"
access-control-max-age
86400
fastly-io-info
ifsz=44391 idim=1600x900 ifmt=jpeg ofsz=7923 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7020
8ed26cb4-b50e-41dd-ba67-e8086312396e.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		69 KB
69 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/8ed26cb4-b50e-41dd-ba67-e8086312396e.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
555c76ffcebb70f2c31d10cebc64edba66846cfee5755ce7fd8cf195ea1c4d0b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
age
882
etag
"LbkCPVVyzDtkYJbZmy6PebvwPwJs2S4k8kI2TvSG5Ro"
access-control-max-age
86400
fastly-io-info
ifsz=235010 idim=1600x900 ifmt=jpeg ofsz=70726 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
70734
937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
222e34a90789c24c76384279358846781b332116af4bc26e5c04439a44c55250

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
age
882
etag
"AjEA2j4c35WeErBHyWuRSWnNTBqPYkgR6bIYAK/sw7k"
access-control-max-age
86400
fastly-io-info
ifsz=110792 idim=1600x900 ifmt=jpeg ofsz=25808 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
25353
28ca3347-a097-4ef3-bf98-57243a8fddba.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/28ca3347-a097-4ef3-bf98-57243a8fddba.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
22e1299474bc27ea501a2ea192fc8de44a72d6be7947c75dd08aedbba683c91b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
age
882
etag
"k8KeyYYnkaAhkpGT//HhZbg8T+MxETwFEQrlX8rarOs"
access-control-max-age
86400
fastly-io-info
ifsz=130632 idim=1600x900 ifmt=jpeg ofsz=28544 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
28087
6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		74 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e4a783177bbd97d5981bdc4b33b9bf4692fb715864e15dd9a693f339e7d01867

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
br
age
882
etag
"3KLLCg4nyGx1kwPDasjRJo6R6JalLWdR34sk2oJAI/I"
access-control-max-age
86400
fastly-io-info
ifsz=267428 idim=1600x800 ifmt=jpeg ofsz=75995 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
76003
floors
api.floors.dev/sgw/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.floors.dev/sgw/v1/floors
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.238.208 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
208.238.227.35.bc.googleusercontent.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload;

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,x-api-key
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
access-control-allow-methods
ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-max-age
3600
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
0
strict-transport-security
max-age=31536000;includeSubDomains;preload;
content-length
0
via
1.1 google
alt-svc
clear
floors
api.floors.dev/sgw/v1/ 		4 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.floors.dev/sgw/v1/floors
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.238.208 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
208.238.227.35.bc.googleusercontent.com
Software
/
Resource Hash
6a9f017be3a24e5b11480d5136da78506f3a6178d1ee6f54931b577fc72ff1ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload;

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
x-api-key
4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
Content-Type
application/json

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:36 GMT
via
1.1 google
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
access-control-max-age
3600
access-control-allow-methods
ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
strict-transport-security
max-age=31536000;includeSubDomains;preload;
alt-svc
clear
expires
0
pv
api.btloader.com/ 		0
96 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/pv?tid=05aGg3opGH&w=5733492711227392&o=5714937848528896&cv=2.0.2-2-gfdc9054&r=false&pageURL=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&upapi=true
Requested by
Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sun, 05 Dec 2021 01:44:36 GMT
cache-control
no-cache, no-store, must-revalidate
vary
Origin
alt-svc
clear
via
1.1 google
horizon_tweet.4027cff8c5dfbbf9b414b0df963e6b7d.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/horizon_tweet.4027cff8c5dfbbf9b414b0df963e6b7d.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81BC) /
Resource Hash
7ca703a20171d4d4440daefb529292d7720e3bb2b0aa1aa6d797228bcd3b762c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Dec 2021 21:34:11 GMT
Server
ECS (cha/81BC)
Age
187648
Etag
"8e55b85bd8d8e443c9a80691ed34d775+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
2438
bridge3.490.0_en.html
imasdk.googleapis.com/js/core/ Frame 51C2 		595 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
197951
date
Wed, 01 Dec 2021 20:47:41 GMT
expires
Thu, 01 Dec 2022 20:47:41 GMT
last-modified
Tue, 30 Nov 2021 18:00:51 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
277015
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
client.js
s0.2mdn.net/instream/video/ Frame A266 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16746
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 01:44:36 GMT
bridge3.490.0_en.html
imasdk.googleapis.com/js/core/ Frame F1E3 		595 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
197951
date
Wed, 01 Dec 2021 20:47:41 GMT
expires
Thu, 01 Dec 2022 20:47:41 GMT
last-modified
Tue, 30 Nov 2021 18:00:51 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
277015
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.490.0_en.html
imasdk.googleapis.com/js/core/ Frame 0955 		595 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
197951
date
Wed, 01 Dec 2021 20:47:41 GMT
expires
Thu, 01 Dec 2022 20:47:41 GMT
last-modified
Tue, 30 Nov 2021 18:00:51 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
277015
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4B4A 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/userSync.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=29489
expires
Sun, 05 Dec 2021 09:56:05 GMT
date
Sun, 05 Dec 2021 01:44:36 GMT
vary
Accept-Encoding
usync.js
eus.rubiconproject.com/ Frame CFD6 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
ea69b75b81243d7429f2762349a7b95e0fc43ca337db14df218371e656286357

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:36 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17702
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:38 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 55A4 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:42:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
99
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:42:57 GMT
vpaid_25214542.js
vpaid.springserve.com/production/ Frame 5F91 		495 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpaid.springserve.com/production/vpaid_25214542.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:9400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 01:33:13 GMT
content-encoding
br
last-modified
Fri, 19 Nov 2021 18:30:16 GMT
server
AmazonS3
age
519084
etag
W/"185feb14359001049d144410afbeaaa4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 aa7679f2d01b23d9a66bfa6e92991b05.cloudfront.net (CloudFront)
cache-control
max-age=2678400
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
losoYixSix5lO_RRwyv-Y6sTDjEsCIRYhasGCM_OyF4CVqWWjJxNDw==
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 2CDD 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:42:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
99
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:42:57 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 4C8D 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:42:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
99
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:42:57 GMT
us
capi.connatix.com/core/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/us?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:35 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
us
capi.connatix.com/core/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/us?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
us
capi.connatix.com/core/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/us?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:36 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
apstag.js
c.amazon-adsystem.com/aax2/ 		134 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
d8c62b0d4ac621bedd0ca5a4e96b12a77118338d4166f94d65c15bb154d455aa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
4VmutqpMSKe44XUliQiub0_OOWAXoLbl
content-encoding
gzip
etag
4da12c74ee926b2a11a4e43bfb72b2fd
age
1523
x-cache
Hit from cloudfront
server
Server
x-amz-rid
1AXJK7YK9WCP0270HSY0
date
Sun, 05 Dec 2021 01:19:40 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 3ad9c28633c81882cba37baccdcf1c62.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
L_0j7tu7MUdnfZbUKJUnPtU5IILJknKRQChStsqHyYhCi0U7zL-WLQ==
op.js
tagan.adlightning.com/freestar/ 		58 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/op.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c8092940d0da633c702f549149732cc636a04efd05b0bb72ae1b7a38b4a106aa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
Imk.hL55kfoqge2j8zj9YIb6TmRX8I0L
content-encoding
gzip
etag
"451770a2c73672eb3c48c10928427abb"
age
144
x-cache
Hit from cloudfront
content-length
24153
x-amz-meta-git_commit
5a99e50
last-modified
Fri, 03 Dec 2021 20:58:55 GMT
server
AmazonS3
date
Sun, 05 Dec 2021 01:42:13 GMT
content-type
application/javascript
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
x-amz-cf-id
Ll861eJ0Cu6vrhJni0ge_40lbj0SgewCL-ItBncuEgVv70CjOI5l2w==
Tweet.html
platform.twitter.com/embed/ Frame CF46 		487 B
1001 B 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81BC) /
Resource Hash
03b0b4ea7bd75f32536e7c0cad82a35dacd449b1f626ef7ffe06591b210363de

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Age
813
Cache-Control
public, max-age=1800
Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:44:36 GMT
Etag
"05f259906620f2f7f0a6236a2691bcda"
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (cha/81BC)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
487
Tweet.html
platform.twitter.com/embed/ Frame 3F7F 		487 B
1002 B 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81BB) /
Resource Hash
03b0b4ea7bd75f32536e7c0cad82a35dacd449b1f626ef7ffe06591b210363de

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Age
1492
Cache-Control
public, max-age=1800
Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:44:36 GMT
Etag
"05f259906620f2f7f0a6236a2691bcda"
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (cha/81BB)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
487
PugMaster
image6.pubmatic.com/AdServer/ Frame 4B4A 		5 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=75311468&p=156592&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
a4cce32b9c0361fb6b4f7b53647c9c0bd178c5ee12f954f4586e5c49e9c4cd2e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
content-type
text/html; charset=UTF-8
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
quant.js
secure.quantserve.com/ 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:61c0:eb61:c438:2f4e , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
487fce51fd801415c362f3f9f2df43c445a4b9ba38f9b6d49dfc898dc85ede94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:36 GMT
content-encoding
gzip
etag
"FMCWFRCBdbNj8Eh2c0G78Q=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Sun, 12 Dec 2021 01:44:36 GMT
freestar.js
dggaenaawxe8z.cloudfront.net/ic/audiencesegment/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dggaenaawxe8z.cloudfront.net/ic/audiencesegment/freestar.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.205.179 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-205-179.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ace5c7a57a33a8c21d81ff1ab27c6e2fb71d14c98f007bc9e990880063a32b42

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 08:07:30 GMT
content-encoding
gzip
last-modified
Mon, 22 Nov 2021 05:51:31 GMT
server
AmazonS3
age
63427
etag
W/"069b7e72e08ae247bc61b83397caaea1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 cb7f1fdf6954dd7324e8117a63207a3c.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
x-amz-cf-id
eoF9fCtHvhcoI3rJrWRjt0qFFWl-Yc2bAY5DG3QlipSJHD6EBiJLkw==
load.js
s.ntv.io/serve/ 		392 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.163 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-163.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
3e6aee43ce232f5c967d532d699c8dd2366873b4a61a6d6cbebb3606174a4a61

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
x-amz-request-id
HBVV9S02R09RAT56
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
2z36AkBChaadYludaE81TTVS5JslCWsqWkFVVqfR+zok7oV/y4/5++FKUCJItKTWKm9jomhQSrQ=
Last-Modified
Thu, 02 Dec 2021 15:07:54 GMT
Server
AmazonS3
ETag
"0de0bc397fd51514098ef13d672152b4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b60f65161ce3517c2794eecab25981c51ffbcbc951a781270403e2f3572d0290

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/svg+xml
fastlane.json
fastlane.rubiconproject.com/a/api/ 		753 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55&rp_schain=1.0,1!freestar.com,412,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-9%2CIAB19-10&tg_i.sectioncat=IAB19-9%2CIAB19-10&tg_i.pagecat=IAB19-9%2CIAB19-10&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.fs_ad_product=stickyFooter&tg_i.dfp_ad_unit_code=15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tg_i.pbadslot=15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tk_flint=pbjs_lite_v4.42.1&x_source.tid=096183e6-56bd-40fe-b39c-9fda547f8e08&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9021414659781501
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c002:200::62 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
0769d8125b946cad18ce6466837731e9333ef912462e0dc28a640f3a67c0b0ce

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:37 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
753
Expires
Wed, 17 Sep 1975 21:32:10 GMT
cygnus
htlb.casalemedia.com/ 		36 B
336 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=393562&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22383e97d00ec445%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%224.42.1%22%2C%22userIds%22%3A%5B%5D%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%224f888531a1bc4c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2252ced7caf18de7%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.199.204.79 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-199-204-79.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d85cc0cba3d32082355e73760d917f9cd6e96150229c18669a3472837c532395

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
x-ak-initial-geo
CC:[CA], RC:[QC], CN:[NA], CIP:[37.120.205.182], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
x-cs-client-geo
19
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
36
x-ak-client-geo
19
expires
Sun, 05 Dec 2021 01:44:37 GMT
v1
dmx.districtm.io/b/ 		0
340 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin, Accept-Encoding
access-control-allow-methods
OPTIONS, POST
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b89971f3ecaecfa-YUL
access-control-allow-headers
origin, content-type
hbjson
grid.bidswitch.net/ 		2 B
318 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://grid.bidswitch.net/hbjson
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.211.165.199 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
199.165.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Server
nginx
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
2
translator
hbopenbid.pubmatic.com/ 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:36 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
343 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
80e607151ca69a45908b33b71d1ebfd50e41bd114808f8c8b5f6a18510124873

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
548 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
0962348d31ed6b62de54fea45aad46976756dd82ffa406385a8fb30b65cccdb6

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
prebid
ads.yieldmo.com/exchange/ 		0
231 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=4.42.1&p=%5B%7B%22placement_id%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22callback_id%22%3A%2218e2a4ce66eb926%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%5D&page_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bust=1638668676958&pr=&scrd=1&dnt=false&description=The%20Emotet%20malware%20was%20considered%20the%20most%20widely%20spread%20malware%20in%20the%20past%2C%20using%20spam%20campaigns%20and%20malicious%20attachments%20to%20distribute%20the%20malware.&title=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&pubcid=35d8131b-5771-46c6-8351-b77ad953c760&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.74.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-74-7.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
arj
freestar-d.openx.net/w/1.0/ 		174 B
505 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=096183e6-56bd-40fe-b39c-9fda547f8e08&nocache=1638668676959&pubcid=35d8131b-5771-46c6-8351-b77ad953c760&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&aus=728x90%2C970x90&divids=bleepingcomputer_970x90_728x90_320x50_sticky&aucs=%252F15184186%252Fbleepingcomputer_970x90_728x90_320x50_sticky%252Fbleepingcomputer_970x90_728x90_320x50_sticky&auid=540959250
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
d3875917853a017de272d67ba71ad727240056792fe20486e527f178dd5b8f0c

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
hb
ssc.33across.com/api/v1/ 		118 B
350 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=dPGcAuqZ0r6Ok4aKlId8sQ
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
a3533670bcdbbf6bf66ca791ac7b15a88812fd3fa15691a48e86cf9d387a57d3

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
auction
tlx.3lift.com/header/ 		19 B
270 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=4.42.1&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.215.212.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-212-25.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ib.adnxs.com/ut/v3/ 		138 B
983 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
abdf06e636278b31f806066b5bca348d0aba0d7f8c2932e22d6f011fadb85a6e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:37 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
79beaf75-9d56-4816-8fde-993e585189b5
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
prebid
prebid.media.net/rtb/ 		13 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
66658c2b2998db7be971185ee18706d3907f15ad4e9d25830fac20130f9b156b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
prebid
ib.adnxs.com/ut/v3/ 		145 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
90782976683bb5396729c871848723e4c6a42cf1b5b73378fdca2ad84590a164
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:37 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
e32bb7ab-4c39-4daf-8860-6bf6978a37fe
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
145
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
khaos.jpg
token.rubiconproject.com/ Frame CFD6 		284 B
920 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://token.rubiconproject.com/khaos.jpg?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
284
X-RPHost
0190a17a18f2299b1b85aeb1793e601c
Content-Type
image/jpg
embed.runtime.73157d07ac400de4c606.js
platform.twitter.com/embed/ Frame CF46 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8197) /
Resource Hash
655e1b1c2df2d432818e7b88a43034255279b0b75d20a08cbca8ff6ccbf85330

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8197)
Age
187649
Etag
"3a95da679725b97563da931fc8fd306d+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
3523
embed.modules.66e311263622456867b1.js
platform.twitter.com/embed/ Frame CF46 		519 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E1) /
Resource Hash
8e60f604f0ca5f472149b3e3a02c184ae1082ad59b54ce7eb26c1b6ff51ccfc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E1)
Age
187649
Etag
"d2a7d4d81994376470f2560f453ad37b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
166772
embed.i18n.c052951fae9a0c2b4020.js
platform.twitter.com/embed/ Frame CF46 		146 B
651 B 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.i18n.c052951fae9a0c2b4020.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81DE) /
Resource Hash
9863c7532e26b3e9a2e1ac1d7ee7d96bc03db512a2af9174aa5c1d07046376cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Methods
GET
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81DE)
Age
187649
Etag
"ae3db27722181e85d0a069a920b4ed89"
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
Content-Length
146
embed.Tweet.c4f48f6a1a0886631005.js
platform.twitter.com/embed/ Frame CF46 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.Tweet.c4f48f6a1a0886631005.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8195) /
Resource Hash
d9473dc254914f26f7000bc3eacc42988538946d23e38b6a98f7648f22e13378

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8195)
Age
187649
Etag
"d9dd9adbd164ddf67c4413784c471ff5+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5739
config
c.amazon-adsystem.com/cdn/prod/ 		662 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com&pubid=0ab198dd-b265-462a-ae36-74e163ad6159
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
a20ccaf6978bd71c43456b6bc78288abdc57c3b6fa987eecb2e9f59b69d384e1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 22:19:16 GMT
via
1.1 3ad9c28633c81882cba37baccdcf1c62.cloudfront.net (CloudFront)
server
Server
age
12320
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
x-amz-cf-pop
EWR53-C3
content-length
662
x-amz-cf-id
VcCodkfRvywU6t8SJGoIuHEylUjL8bR-lBRBmqeGrbl3Smq_1ziDzA==
bid
c.amazon-adsystem.com/e/dtb/ 		182 B
658 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&pid=5QEbdpiVtJDns&cb=0&ws=1600x1200&v=7.71.1&t=1000&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%5D&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
df888bff9ec6e7f70b4e273ccbbcc1adb8dd8b4c725ae2860ca434f51ff36bbf
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
via
1.1 3ad9c28633c81882cba37baccdcf1c62.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
EWR53-C3
x-amz-rid
9MR00AT4Q4X5RXB05JMJ
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
182
x-amz-cf-id
dUOZ9US33p4dpzaAhJ4VkjPX391kk7svCJHMz8HrKN3WoBEPAYgBUg==
bid
c.amazon-adsystem.com/e/dtb/ 		182 B
657 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&pid=5QEbdpiVtJDns&cb=1&ws=1600x1200&v=7.71.1&t=1000&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_728x90_320x50_InContent_1%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_2%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_3%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
8569f8a54b841f9b5cbfbf1f340a1c29ee63e52b2fbf042d1b54bd9f5bcbbb07
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
via
1.1 3ad9c28633c81882cba37baccdcf1c62.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
EWR53-C3
x-amz-rid
1RRHSVWZM0FEBNE5SCVS
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
182
x-amz-cf-id
p7R8NNqLj_C9pfRDgbqVsqoF-Rhf7-G3SmdcMtblTrx1bQUBUPCdIQ==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 13:04:08 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin
age
45629
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Tue, 09 Nov 2021 22:55:20 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
gYbY2ORQY5Qmsyt0ob0SiGH6tjIhuo4B
via
1.1 004bca22aa9bfed50552852ad27c49a6.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
EWR53-C3
content-type
application/javascript
x-amz-cf-id
3MtVHZIFq4ttdfYoQLh34rtHjHL_31TSo3Fnzwxcyn-GwaasADK34A==
async_usersync.html
acdn.adnxs.com/dmp/ Frame 8316 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:39 GMT
Date
Sun, 05 Dec 2021 01:44:37 GMT
Connection
keep-alive
Vary
Accept-Encoding
prebid
ib.adnxs.com/ut/v3/ Frame 5F91 		160 B
1005 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
b4e1164655d4f49235af7c4a51c4eccacbff1261e53ca7f72b1d8da8bde1ef94
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:37 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
d9d3df2b-62dd-470d-a01c-1e90999eee2a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
160
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 5F91 		0
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
ads.adaptv.advertising.com/rtb/ Frame 5F91 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
openrtb
ads.adaptv.advertising.com/rtb/ Frame 5F91 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
embed.runtime.73157d07ac400de4c606.js
platform.twitter.com/embed/ Frame 3F7F 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8197) /
Resource Hash
655e1b1c2df2d432818e7b88a43034255279b0b75d20a08cbca8ff6ccbf85330

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8197)
Age
187649
Etag
"3a95da679725b97563da931fc8fd306d+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
3523
embed.modules.66e311263622456867b1.js
platform.twitter.com/embed/ Frame 3F7F 		519 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E1) /
Resource Hash
8e60f604f0ca5f472149b3e3a02c184ae1082ad59b54ce7eb26c1b6ff51ccfc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E1)
Age
187649
Etag
"d2a7d4d81994376470f2560f453ad37b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
166772
embed.i18n.c052951fae9a0c2b4020.js
platform.twitter.com/embed/ Frame 3F7F 		146 B
651 B 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.i18n.c052951fae9a0c2b4020.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81DE) /
Resource Hash
9863c7532e26b3e9a2e1ac1d7ee7d96bc03db512a2af9174aa5c1d07046376cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Methods
GET
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81DE)
Age
187649
Etag
"ae3db27722181e85d0a069a920b4ed89"
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
Content-Length
146
embed.Tweet.c4f48f6a1a0886631005.js
platform.twitter.com/embed/ Frame 3F7F 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.Tweet.c4f48f6a1a0886631005.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8195) /
Resource Hash
d9473dc254914f26f7000bc3eacc42988538946d23e38b6a98f7648f22e13378

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8195)
Age
187649
Etag
"d9dd9adbd164ddf67c4413784c471ff5+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5739
match
c1.adform.net/serving/cookie/ Frame 8091
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&cid=F458BC18-DC0D-48F9-98CC-615D57A2C396
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F458BC18-DC0D-48F9-98CC-615D57A2C396
35 B
477 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-length
0
location
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F458BC18-DC0D-48F9-98CC-615D57A2C396
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains
Pug
simage2.pubmatic.com/AdServer/ Frame 7D8B
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YawZhQAJhLX5VAAz&gdpr=0&gdpr_consent=&_test=YawZhQAJhLX5VAAz
1 B
257 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YawZhQAJhLX5VAAz&gdpr=0&gdpr_consent=&_test=YawZhQAJhLX5VAAz
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
text/html; charset=utf-8
content-length
1
x-lat
njrpug009:0:481
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
Varnish
retry-after
0
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YawZhQAJhLX5VAAz&gdpr=0&gdpr_consent=&_test=YawZhQAJhLX5VAAz
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:44:37 GMT
via
1.1 varnish
x-served-by
cache-yul12823-YUL
x-cache
HIT
x-cache-hits
0
x-timer
S1638668677.193250,VS0,VE0
cache-control
no-cache
pragma
no-cache
content-length
0
adx
match.prod.bidr.io/cookie-sync/ Frame 6BD4
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFGWWFFN0RXRE1BQUN1WG5naTdWdw&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
43 B
430 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.233.68.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-233-68-37.compute-1.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

cache-control
no-cache, must-revalidate
content-type
image/gif
Date
Sun, 05 Dec 2021 01:44:37 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma
no-cache
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
43
Connection
keep-alive

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
date
Sun, 05 Dec 2021 01:44:37 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
content-length
361
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
usersync.aspx
widget.us.criteo.com/dis/ Frame 0FB5
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
  • https://widget.us.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybac...
43 B
334 B 		Document
General
Check archive.org
Download Go to
Full URL
https://widget.us.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif
server
Kestrel
cache-control
no-cache
pragma
no-cache
expires
Sun, 05 Dec 2021 00:00:00 GMT
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
340970

Redirect headers

date
Sun, 05 Dec 2021 01:44:36 GMT
server
Kestrel
content-length
0
location
https://widget.us.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
server-processing-duration-in-ticks
303490
141
match.deepintent.com/usersync/ Frame AA5E 		0
221 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
content-type
image/gif
content-length
0
date
Sun, 05 Dec 2021 01:44:36 GMT
server
b
Pug
simage2.pubmatic.com/AdServer/ Frame C8B9
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e798f20a-556c-11ec-a6a1-d15af7eee1bc
42 B
222 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e798f20a-556c-11ec-a6a1-d15af7eee1bc
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug005:0:521
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Type
image/gif
Content-Length
0
Connection
keep-alive
server
Cowboy
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e798f20a-556c-11ec-a6a1-d15af7eee1bc
X-RealServer-NX
lga-delivery-6
Cache-Control
no-cache, no-store, must-revalidate, proxy-revalidate
Pragma
no-cache
Expires
Thu, 23 Sep 2004 17:42:04 GMT
P3P
CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin
*
Pug
simage2.pubmatic.com/AdServer/ Frame E2F6
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=11
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=fjjYmhumTpxKx2Vf1I9_oCV4zbY
42 B
218 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=fjjYmhumTpxKx2Vf1I9_oCV4zbY
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug001:0:425
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:44:37 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=fjjYmhumTpxKx2Vf1I9_oCV4zbY
Content-Length
159
Connection
keep-alive
i.match
s.tribalfusion.com/z/ Frame 967A
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
413 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif; charset=utf-8
content-length
43
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
302
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6b899720fc967157-YUL
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
text/html
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
206
x-reuse-index
3968
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6b8997206bd37157-YUL
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Pug
simage2.pubmatic.com/AdServer/ Frame B2FD
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:IoqlAHf41MTGzX5&gdpr=0&gdpr_consent=
42 B
212 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:IoqlAHf41MTGzX5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug019:0:682
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Cache-Control
no-cache, must-revalidate
Date
Sun, 05 Dec 2021 01:44:37 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:IoqlAHf41MTGzX5&gdpr=0&gdpr_consent=
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Pragma
no-cache
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-09b28297f33b5541d@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Content-Length
0
Connection
keep-alive
usersync
match.bnmla.com/ Frame 5A5A 		0
114 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
38.27.122.101 , United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Length
0
Connection
keep-alive
Pug
simage2.pubmatic.com/AdServer/ Frame 3DCF
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8177775240
  • https://sync.1rx.io/usersync/tradedesk/7de5ca57-c954-4db1-bc90-ae26323dfac5
  • https://sync.targeting.unrulymedia.com/csync/RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005
42 B
384 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 00:19:56 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug026:0:568
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Server
Tengine
Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005
ETag
RXda0032b492b14af48df546d6bf174e13005
Pug
simage2.pubmatic.com/AdServer/ Frame 7C66
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=6
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627775726303
42 B
516 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627775726303
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug017:0:440
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Content-Length
0
Access-Control-Allow-Origin
*
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627775726303
Pug
image2.pubmatic.com/AdServer/ Frame 64C0
Redirect Chain
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=2136b91a-fbec-4195-88cb-b89bb6bd2966
1 B
254 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=2136b91a-fbec-4195-88cb-b89bb6bd2966
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
text/html; charset=utf-8
content-length
1
x-lat
njrpug003:0:519
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-length
0
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=2136b91a-fbec-4195-88cb-b89bb6bd2966
expires
Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security
max-age=15724800; includeSubDomains
Pug
simage2.pubmatic.com/AdServer/ Frame DF59
Redirect Chain
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ6919550771882466910&uid=Q691955077188246...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919550771882466910
42 B
235 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919550771882466910
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:37 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug011:0:3513
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Server
Apache/2.2.15 (CentOS)
Content-Length
154
Content-Type
text/html
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919550771882466910
X-Powered-By
PHP/5.3.3
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary
Accept-Encoding
Cache-Control
max-age=15689
Date
Sun, 05 Dec 2021 01:44:37 GMT
Connection
keep-alive
us
capi.connatix.com/core/ Frame C22F 		0
156 B 		Document
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/us?DemandPartner=2&UserId=cee0a083e7aa41ee905839ad8069ffb9&DemandPartnerName=Pubmatic&DemandPartnerUserId=F458BC18-DC0D-48F9-98CC-615D57A2C396
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

access-control-allow-credentials
true
date
Sun, 05 Dec 2021 01:44:36 GMT
server
Kestrel
Content-Length
0
Connection
keep-alive
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4B4A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9Fi8GNwNSPmYzGFdV6LDlg%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:03 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3945-5c4c7cc02bd56"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=29488
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5054
expires
Sun, 05 Dec 2021 09:56:05 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
458249.gif
idsync.rlcdn.com/ Frame 4B4A
Redirect Chain
  • https://idsync.rlcdn.com/420486.gif?partner_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396
  • https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEY0NThCQzE4LURDMEQtNDhGOS05OENDLTYxNUQ1N0EyQzM5NhAAGg0IhbOwjQYSBQjoBxAAQgBKAA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=7634a8b55d5d17697c837fabe067bae90b90bd00f44939de46d464690f169edb791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA3NjM0YThiNTVkNWQxNzY5N2M4MzdmYWJlMDY3YmFlOTBiOTBiZDAwZjQ0OTM5ZGU0NmQ0NjQ2OTBmMTY5ZWRiNzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA3NjM0YThiNTVkNWQxNzY5N2M4MzdmYWJlMDY3YmFlOTBiOTBiZDAwZjQ0OTM5ZGU0NmQ0NjQ2OTBmMTY5ZWRiNzkxNDI2YjU0MTdkY2UyMRAAGgwIhbOwjQYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=ec534934-9cc6-4add-95e8-09698ea33a4c
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=ec534934-9cc6-4add-95e8-09698ea33a4c
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:38 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=ec534934-9cc6-4add-95e8-09698ea33a4c
date
Sun, 05 Dec 2021 01:44:38 GMT
via
1.1 google
x-samesite
secure
alt-svc
clear
content-length
111
content-type
text/html; charset=utf-8
SPug
image4.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=80ca61ac-1985-4400-a48d-b90a57bd0cef
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=80ca61ac-1985-4400-a48d-b90a57bd0cef
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Server
MT3 4133 baa842e master iad-pixel-x14 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=80ca61ac-1985-4400-a48d-b90a57bd0cef
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:36 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjQ1OEJDMTgtREMwRC00OEY5LTk4Q0MtNjE1RDU3QTJDMzk2&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
129 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug001:0:449
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECQ-IpU7YaeY8-QgpjBoaHI&google_cver=1
42 B
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECQ-IpU7YaeY8-QgpjBoaHI&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug013:0:589
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECQ-IpU7YaeY8-QgpjBoaHI&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
42 B
225 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug003:0:972
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date
Sun, 05 Dec 2021 01:44:37 GMT
x-content-type-options
nosniff
server
nginx
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Sat, 04 Dec 2021 01:44:37 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
1 B
457 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug017:0:427
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:36 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7de5ca57-c954-4db1-bc90-ae26323dfac5
42 B
293 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7de5ca57-c954-4db1-bc90-ae26323dfac5
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug014:0:404
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=7de5ca57-c954-4db1-bc90-ae26323dfac5
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
Pug
simage2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:badc61ac-1985-4000-9788-0d2b1d82255b&gdpr=0&gdpr_consent=
42 B
496 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:badc61ac-1985-4000-9788-0d2b1d82255b&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 23:57:53 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug027:0:386
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Server
MT3 4133 baa842e master iad-pixel-x12 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:badc61ac-1985-4000-9788-0d2b1d82255b&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:36 GMT
SPug
image4.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-ecqHBIxE2uVNT64m3DWaV2XDOBvGQcM-~A&gdpr=0&gdpr_consent=
0
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-ecqHBIxE2uVNT64m3DWaV2XDOBvGQcM-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:35 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-ecqHBIxE2uVNT64m3DWaV2XDOBvGQcM-~A&gdpr=0&gdpr_consent=
date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
F458BC18-DC0D-48F9-98CC-615D57A2C396
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 4B4A 		43 B
874 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/F458BC18-DC0D-48F9-98CC-615D57A2C396?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
Pug
image2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8987304192775495297&gdpr=0&gdpr_consent=
42 B
366 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8987304192775495297&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:01:49 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug028:0:416
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:37 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
f941e80f-cc0b-444e-a40d-b5cbfb12b498
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8987304192775495297&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=0&gdpr_consent=
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=39ddf25e9e041204&is_secure=true&networkId=17100&version=1&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGZoispQrBKwNStWDnAAAAAAA&expiration=1638755078&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&...
42 B
437 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGZoispQrBKwNStWDnAAAAAAA&expiration=1638755078&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&is_secure=true&gdpr_consent=&gdpr=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 23:57:54 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug027:0:506
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGZoispQrBKwNStWDnAAAAAAA&expiration=1638755078&nuid=F458BC18-DC0D-48F9-98CC-615D57A2C396&is_secure=true&gdpr_consent=&gdpr=0
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 4B4A 		0
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.202.47.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-47-217.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
0
Content-Type
text/plain
Pug
simage2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e7d04ec6-556c-11ec-b6dc-73502c1f30ef&gdpr=0&gdpr_consent=
1 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e7d04ec6-556c-11ec-b6dc-73502c1f30ef&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug002:0:407
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=e7d04ec6-556c-11ec-b6dc-73502c1f30ef&gdpr=0&gdpr_consent=
Date
Sun, 05 Dec 2021 01:44:37 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
e7d04ec7-556c-11ec-b6dc-73502c1f30ef
sn.ashx
pmp.mxptint.net/ Frame 4B4A
Redirect Chain
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1D531_E7994491_27E6AF978&r=https://pmp.mxptint.net/sn.ashx?ak=1
  • https://pmp.mxptint.net/sn.ashx?ak=1
43 B
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmp.mxptint.net/sn.ashx?ak=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Server
38.67.14.233 , United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Strict-Transport-Security max-age=-321655478; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:38 GMT
Cache-Control
no-cache
Expires
-1
Content-Length
43
Strict-Transport-Security
max-age=-321655478; includeSubDomains
Content-Type
image/gif

Redirect headers

location
https://pmp.mxptint.net/sn.ashx?ak=1
date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug004:0:552
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Pug
image2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&gdpr=0&gdpr_consent=
42 B
387 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:06:39 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug030:0:487
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=QFKA4Uda2bdbVNnjF1XMs0AF1LBbUNbmFFMfEY-s
42 B
467 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=QFKA4Uda2bdbVNnjF1XMs0AF1LBbUNbmFFMfEY-s
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:06:38 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug030:0:560
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=QFKA4Uda2bdbVNnjF1XMs0AF1LBbUNbmFFMfEY-s
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
  • https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=445d1fc1-46d4-494d-842f-cfe15cd6e197&ssp=pubmatic
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
1 B
181 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug006:0:450
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:44:38 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Pug
simage2.pubmatic.com/AdServer/ Frame 4B4A
Redirect Chain
  • https://sync.resetdigital.co:10001/csync/pubmatic
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA38D9B9F
42 B
210 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA38D9B9F
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug020:0:778
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Sun, 05 Dec 2021 01:44:40 GMT
Server
nginx/1.18.0 (Ubuntu)
Front-End-Https
on
Content-Type
text/html
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA38D9B9F
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1444716
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
OHxVshgVvA9i4bBi3bUiANc14hkwr2K6dqTu89M90zrC_IdIYlqdDQ==
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102634
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
m21Kd9qEigOvoEvOD6f8oJvDgK_XGvOX5kC4si-4FbZWz7GH6bF90w==
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92e649098eefaf82db65282d7cbb4e65c738aca33c3fc8073a9c770fbcb0623d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/webp
548bdb63b969e5c27f75e62faf543d70.js
www.gstatic.com/mysidia/ Frame 9809 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/548bdb63b969e5c27f75e62faf543d70.js?tag=client_fast_engine_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 00:14:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
437412
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3286
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 04:29:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Mon, 28 Feb 2022 00:14:25 GMT
css
fonts.googleapis.com/ Frame 9809 		8 KB
714 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:40:21 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:44:37 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:44:37 GMT
pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 		53 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.5.238.78 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-5-238-78.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
last-modified
Tue, 01 Jun 2021 17:06:57 GMT
server
Apache
etag
"d398-5c3b75e9ebb41-gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=900
accept-ranges
bytes
content-length
17087
expires
Sun, 05 Dec 2021 01:59:37 GMT
id5-api.js
cdn.id5-sync.com/api/1.0/ 		35 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.202.126 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cacheable
Matched cache
x-cdn-pop-ip
137.74.122.0/26
date
Sun, 05 Dec 2021 00:56:44 GMT
content-type
text/javascript;charset=utf-8
cache-control
max-age=3600
x-cdn-pop
bhs
content-disposition
attachment;filename="id5-api.js"
accept-ranges
bytes
content-length
10053
x-request-id
389908907
rules-p-UeXruRVtZz7w6.js
rules.quantcount.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-UeXruRVtZz7w6.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:9a00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a7b5f5f96f81dea4efc53e1d4dae8b37c28bec27a45b42ccf604ee759e20caec

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:57:24 GMT
content-encoding
gzip
age
2834
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
last-modified
Thu, 07 Dec 2017 17:06:25 GMT
server
AmazonS3
etag
W/"cbc97d16c77ea1fcbbf42d246001e982"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 0a84c1b70b100e694edd23e638bf7fa9.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
wdBen1skclUEc7ofXJ9a_Ri5yCjVfemVfgSetX4ba8hBYS_vP98I6A==
pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
a.pub.network/core/pubfig/ 		182 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50a427a86edd270a769be6b028c0513a241e39b623e44774b9fa7ad4aeb6b084

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=wLSKRQ==, md5=Idua+ByzLTp8zzRhkdYDlA==
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
363166
x-guploader-uploadid
ADPycduhmtYH3FUx7LqvrdsYBzin6415otMowGE46Y5BiA5RCzgyspkZwtitWe0tF-ETYB-J4zbLIbWdv2bFDFYhLvw5XK3Tyw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Thu, 18 Nov 2021 17:40:17 GMT
server
cloudflare
etag
W/"21db9af81cb32d3a7ccf346191d60394"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FAWSTrLttbkqSHlZbnc200KFrDWW%2F3jMgglNiRM4gX3VokQlcqKWIcKcZFBVInEzGeyp%2BpUdPfgIBRFw61S8pbo0yScy0LWTzA4YGFdCRbgrlqzfw0mKHKJHxZOLF0WWQquGWx%2FdaOv1W%2FY%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1637257217859608
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
186040
cf-ray
6b899720eca7713e-YUL
expires
Tue, 30 Nov 2021 21:45:13 GMT
prebid
ads.yieldmo.com/exchange/ 		0
230 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=4.42.1&p=%5B%7B%22placement_id%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%2C%22callback_id%22%3A%2236cf725eae51754%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_728x90_320x50_InContent_1%22%2C%22callback_id%22%3A%2237048fc09132438%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_2%22%2C%22callback_id%22%3A%223884a3689ebd26b%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_3%22%2C%22callback_id%22%3A%223942d1f985fa237%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%2C%22callback_id%22%3A%224067b0c3438462e%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%5D&page_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bust=1638668677260&pr=&scrd=1&dnt=false&description=The%20Emotet%20malware%20was%20considered%20the%20most%20widely%20spread%20malware%20in%20the%20past%2C%20using%20spam%20campaigns%20and%20malicious%20attachments%20to%20distribute%20the%20malware.&title=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&pubcid=35d8131b-5771-46c6-8351-b77ad953c760&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.74.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-74-7.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
arj
freestar-d.openx.net/w/1.0/ 		175 B
189 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=105650f9-1527-4786-af7c-574c1e4a000b%2Cd6e8b709-3a96-479c-990e-a8921a3261c8%2Ce3d85d08-2949-49c8-8b71-cd7db3d848e6%2Cd39da4b4-1eda-4666-8bfe-812553105a82%2Ce316ed69-95c5-416a-9013-d599e7e17e23&nocache=1638668677261&pubcid=35d8131b-5771-46c6-8351-b77ad953c760&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%7C300x250%2C300x600%7C300x250%2C300x600%7C728x90%2C970x90%2C970x250&divids=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_300x250_300x600_160x600_Right_3%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&aucs=%252F15184186%252Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%252Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2C%252F15184186%252Fbleepingcomputer_728x90_320x50_InContent_1%252Fbleepingcomputer_728x90_320x50_InContent_1%2C%252F15184186%252Fbleepingcomputer_300x250_300x600_160x600_Right_2%252Fbleepingcomputer_300x250_300x600_160x600_Right_2%2C%252F15184186%252Fbleepingcomputer_300x250_300x600_160x600_Right_3%252Fbleepingcomputer_300x250_300x600_160x600_Right_3%2C%252F15184186%252Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%252Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250%2C540959250%2C540959250%2C540959250%2C540959250
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
ad47fb163aa0ec7784d307b56c29fe2ecc34b37588f3a8e086fb2baa7a524825

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
166
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
2da05d5c1e5b6415b70de890846fcd373dab2151747976fa9776fc9f89af97e0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194700601d06e7&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
d86e874d5af977ac1fbced09c5a7180b76f560ca8b5f85bdacf063654639dd76

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
28a3ec1793ece736d1bbd95c5f8e457f47e0a5473339a6ffa0d45e875f5bc5d7

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
726165c339922323b114b0d17ef447e7306c3c0221dc0a49375d7673a3ecbdfb

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707caca0954&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
df3d6be6cee7a0293e21c1b3dee050c2c1a913a5a753663df209345be77b443e

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969412017474441319470061cb06e8&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
c8b895ad0d60f306a58616fa23f9fadd60919edbd25f4d3553388d693a90eda6

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707caca0954&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
1d0b406d9f024c1101f5cb159e169fa0a803b595673c72acf165656c94f35393

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969412017474441319470061cb06e8&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
c7610165e7f527b5dae9ec4327ac81a68e0bef162a758b9a043d2a28b4b26341

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
1185224870c6f5694bb53b88a691075e94a419665ca626df7e026e620f561566

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194700601d06e7&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
41ae990b4b47df05c2c0f3df04d18956fcd62639f47301fab46965026c878247

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
9c9f55123bff498d0ce32c3417c43af4a71ba9ef7b24aed3726ffe7bde67b18c

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
prebid
ib.adnxs.com/ut/v3/ 		594 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
99dfaad0d22db1317db6463337f40111a17124c49f61df9e0404cf2865383b61
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
a23fb577-7931-4e77-bdaf-571386b7b156
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
hb.emxdgt.com/ 		0
165 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.emxdgt.com/?t=1200&ts=1638668677269&src=pbjs
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.21.96.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-21-96-249.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
security, Content-Type
hbjson
grid.bidswitch.net/ 		2 B
318 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://grid.bidswitch.net/hbjson
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.211.165.199 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
199.165.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Server
nginx
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
2
prebid
ib.adnxs.com/ut/v3/ 		99 KB
21 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
a10b1c7f97ebd8b3b97246dd00d29bfb860b9a203aedc81c8e94efbf59f6a8ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
827369e0-f6c7-40f3-b4a0-20b265cac891
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
htlb.casalemedia.com/ 		4 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=393562&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22866ffb8a57f5475%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A5%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A5%2C%22ren%22%3Afalse%2C%22version%22%3A%224.42.1%22%2C%22userIds%22%3A%5B%5D%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%228749cf4ce4c9ed9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2288e07dc78c92246%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22894c36a1cb08fc8%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2290935f147e28481%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22910fc86ba14363%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2292c8838ca8297a7%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2293ce231e12d1351%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2294f5a5a3e60a647%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%229505657e7dc7bce%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%229696bb58ccf7fa6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2297776a39c968ad6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.199.204.79 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-199-204-79.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3c0e96bd82e30f54f74b90774f36d30a7d7224671644263dc4cb393d2b3a25e3

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
x-ak-initial-geo
CC:[CA], RC:[QC], CN:[NA], CIP:[37.120.205.182], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
x-cs-client-geo
19
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
3779
x-ak-client-geo
19
expires
Sun, 05 Dec 2021 01:44:37 GMT
translator
hbopenbid.pubmatic.com/ 		139 KB
43 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
13dc2a27361e4dd4af160a4adfb7b8185e6975c65702bc477587607533c9712e

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
x-openrtb-version
2.3
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
205 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.21.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-21-104.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Date
Sun, 05 Dec 2021 01:44:37 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
Vary
Origin
auction
tlx.3lift.com/header/ 		29 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=4.42.1&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.215.212.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-212-25.compute-1.amazonaws.com
Software
/
Resource Hash
66cc9a6743588321c2f117d4b0fa8d8347f581ca9c50af6a959c7fa23eb5883c
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
6991
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
v1
dmx.districtm.io/b/ 		0
38 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin, Accept-Encoding
access-control-allow-methods
OPTIONS, POST
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b8997211886ecfa-YUL
access-control-allow-headers
origin, content-type
prebid
prebid.media.net/rtb/ 		71 KB
12 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
cdb9820e4bfa57d0a170e049d2cd884e300c5bdf0c837e5924b6bbaf710c5545

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
fastlane.json
fastlane.rubiconproject.com/a/api/ 		1 KB
984 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2%3B2%3B15%3B15%3B2&alt_size_ids=55%2C57%3B%3B10%3B10%3B55%2C57&rp_schain=1.0,1!freestar.com,412,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-9%2CIAB19-10&tg_i.sectioncat=IAB19-9%2CIAB19-10&tg_i.pagecat=IAB19-9%2CIAB19-10&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.fs_ad_product=banner&tg_i.dfp_ad_unit_code=15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%3B15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%3B15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&tg_i.pbadslot=15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%3B15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%2Fbleepingcomputer_728x90_320x50_InContent_1%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%3B15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&tk_flint=pbjs_lite_v4.42.1&x_source.tid=105650f9-1527-4786-af7c-574c1e4a000b%3Bd6e8b709-3a96-479c-990e-a8921a3261c8%3Be3d85d08-2949-49c8-8b71-cd7db3d848e6%3Bd39da4b4-1eda-4666-8bfe-812553105a82%3Be316ed69-95c5-416a-9013-d599e7e17e23&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=5&rand=0.82209469029962
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c002:200::62 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
5414daf75d510ecc695f41229d2523921da62e596d787693b21f9443d1bd019b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
495
Expires
Wed, 17 Sep 1975 21:32:10 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 9809 		1 KB
881 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:37:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
454
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
853
x-xss-protection
0
server
cafe
etag
7170004918125193417
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:37:03 GMT
b11ca96b96753a896831283c9f885acc.js
www.gstatic.com/mysidia/ Frame 9809 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/b11ca96b96753a896831283c9f885acc.js?tag=exit_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4beda28dcae03d0a09cf69fca1ebf4479111dd8479ac6657815888be6841a194
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 01:24:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
173997
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8028
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 04:29:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Thu, 03 Mar 2022 01:24:40 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 9809 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:40:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
223
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7857
x-xss-protection
0
server
cafe
etag
2255741555227857113
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:40:54 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 9809 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:43:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
67
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:43:30 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9809 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:37 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 9809 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:43:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
87
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:43:10 GMT
us
capi.connatix.com/core/ Frame CFD6
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=19564_2
  • https://ck.connatix.com/cks?pid=11&uid=KWSL0RE8-3-ILJG
  • https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL0RE8-3-ILJG&UserId=
0
156 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL0RE8-3-ILJG&UserId=
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0

Redirect headers

date
Sun, 05 Dec 2021 01:44:37 GMT
location
https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL0RE8-3-ILJG&UserId=
access-control-max-age
86400
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
content-length
0
retry-after
0
womptv2nm.js
cdn.krxd.net/controltag/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/controltag/womptv2nm.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e1023fc5b7b2cb762dd4ad14fcf4787fa945fca4a37518cd0d6b411c248dc201

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date
Sun, 05 Dec 2021 01:44:37 GMT
via
1.1 varnish, 1.1 varnish
age
1075
x-cache
MISS, HIT, HIT
x-app-cache
HIT
x-age
0
content-encoding
gzip
content-length
3716
x-served-by
config-service-a005-ash-prod.krxd.net, cache-bwi5155-BWI, cache-yul12826-YUL
x-response-time
1
x-do-esi
esi
x-timer
S1638668677.490276,VS0,VE0
etag
"fa213313d0f749c73627133b4ab4942a6489b2c7"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=1200
accept-ranges
bytes
x-cache-hits
0, 4, 756
logs
uat5-a.investingchannel.com/ 		0
455 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://uat5-a.investingchannel.com/logs?gdprapplicable=false&uspstatus=NOT_APPLICABLE
Requested by
Host: dggaenaawxe8z.cloudfront.net
URL: https://dggaenaawxe8z.cloudfront.net/ic/audiencesegment/freestar.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.92.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-92-17.compute-1.amazonaws.com
Software
Jetty(9.4.12.v20180830) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
server
Jetty(9.4.12.v20180830)
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
logs
uat5-a.investingchannel.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://uat5-a.investingchannel.com/logs?gdprapplicable=false&uspstatus=NOT_APPLICABLE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.92.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-92-17.compute-1.amazonaws.com
Software
Jetty(9.4.12.v20180830) /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-length
0
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
server
Jetty(9.4.12.v20180830)
t
jadserve.postrelease.com/ 		288 B
760 B 		Script
General
Check archive.org
Download Go to
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ntv_mvi
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.209.200.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-209-200-15.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
f05b8afebdc73dd7fba72a52adc8d698505e2012f6cfac604e5eba06bbeb8e53

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
text/javascript;charset=UTF-8
content-length
231
expires
Mon, 1 Jan 1990 12:00:00 GMT
integrator.js
adservice.google.ca/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		17 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3364310970517454&correlator=1084947904008309&output=ldjh&impl=fifs&eid=31061814%2C31063378%2C31060890&vrg=2021113001&ptt=17&sc=1&sfv=1-0-38&ecs=20211205&iu_parts=15184186%2Cbleepingcomputer_970x90_728x90_320x50_sticky&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26floors_id%3D5c692c%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_970x90_728x90_320x50_sticky%26fs_ad_product%3DstickyFooter%26amznbid%3D2%26amznp%3D2%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dmedianet_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.01%26hb_adid%3D1587b5e433745e37%26hb_bidder%3Dmedianet&eri=1&cust_params=user-agent%3DChrome%26section%3Dnews&cookie=ID%3D464ce9abc714bc84-2282398380ce00f0%3AT%3D1638668676%3ART%3D1638668676%3AS%3DALNI_MbxbBjOmkAbTLmyUtXzPIFFjq2MHg&bc=31&abxe=1&lmt=1637072838&dt=1638668677601&dlt=1638668675390&idt=1164&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=1110&adks=3056404191&ucis=1&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=true&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021113001.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
1263cf1317b60eb2243d9d60b2772b31f665732c3c92553f1403be5f7858b267
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9541
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 28AC 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021113001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Sun, 05 Dec 2021 01:44:37 GMT
expires
Mon, 05 Dec 2022 01:44:37 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 5F91 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668676602&gdpr=&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
4ac776207c5b693e5588a6e485f418c892c8aabeaf94cde12ed1ec57d329e32c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
server
adaptv/1.0
content-type
text/xml
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
954
expires
0
tap.php
pixel.rubiconproject.com/ Frame CFD6
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/eUHPBa6A6YVH7HoShjuCtQ?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3913413988169684362
42 B
708 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3913413988169684362
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
29af2665c43893332e84c235bac366c1
Content-Type
image/gif

Redirect headers

date
Sun, 05 Dec 2021 01:44:38 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3913413988169684362
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
pixel
cm.g.doubleclick.net/ Frame CFD6
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTIyMGM4OWI1YmFiYWFlZDJiMTBiYTkyNmI4NjU3NTFmOTc4OWNkNw
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTIyMGM4OWI1YmFiYWFlZDJiMTBiYTkyNmI4NjU3NTFmOTc4OWNkNw
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZTIyMGM4OWI1YmFiYWFlZDJiMTBiYTkyNmI4NjU3NTFmOTc4OWNkNw
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
84e0f527cd81a00b0210e20b4ee7ed94
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame CFD6
Redirect Chain
  • https://match.adsrvr.org/track/cmf/rubicon
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=&expires=30
42 B
708 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
f69a50991384d09413b97a37bb74928b
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=&expires=30
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
289
pixel
cm.g.doubleclick.net/ Frame CFD6
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
e1bddfc34a927e97bda010c0d8a62b62
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame CFD6
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YawZhQAJhLX5VAAz
42 B
708 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YawZhQAJhLX5VAAz
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
8eb2d9eeed9b9c468975d0ba24565e5b
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:37 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638668678.633167,VS0,VE0
x-served-by
cache-yul12823-YUL
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YawZhQAJhLX5VAAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
709414.gif
id.rlcdn.com/ Frame CFD6 		42 B
319 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:37 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
tap.php
pixel.rubiconproject.com/ Frame CFD6
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=badc61ac-1985-4000-9788-0d2b1d82255b&expires=28
42 B
708 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=badc61ac-1985-4000-9788-0d2b1d82255b&expires=28
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
0228ab361cece0438ff9eb16e4e5890e
Content-Type
image/gif

Redirect headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Server
MT3 4133 baa842e master iad-pixel-x4 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=badc61ac-1985-4000-9788-0d2b1d82255b&expires=28
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:36 GMT
v1
ads.yahoo.com/cms/ Frame CFD6
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWSL0RE8-3-ILJG&sigv=1&esig=2~f5d4f115f7338e69422e260c048d59e3fc9a15fc
0
444 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWSL0RE8-3-ILJG&sigv=1&esig=2~f5d4f115f7338e69422e260c048d59e3fc9a15fc
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
H2
Server
2001:4998:14:800::1001 Ashburn, United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWSL0RE8-3-ILJG&sigv=1&esig=2~f5d4f115f7338e69422e260c048d59e3fc9a15fc
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
78008fe701b681dce86a72fc23cacc40
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
downsize_200k_v1
tpc.googlesyndication.com/simgad/14821522437215773548/ Frame 9809 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/14821522437215773548/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08317f599d67cf552a32fc308e2dd500f03ea0ff9c3fc3e7a7dc0d7c9047d375
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 16:22:46 GMT
x-content-type-options
nosniff
age
292911
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41901
x-xss-protection
0
last-modified
Wed, 01 Sep 2021 20:03:18 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 01 Dec 2022 16:22:46 GMT
15993820937207506906
tpc.googlesyndication.com/icore_images/ Frame 9809 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/15993820937207506906
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5cbd8dc729043efb7fe66a51d9d5eda549dec7321059f03f3be5665d1e9ea027
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 23:14:13 GMT
x-content-type-options
nosniff
age
95424
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9182
x-xss-protection
0
last-modified
Mon, 31 Jul 2017 18:26:56 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 03 Dec 2022 23:14:13 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/16248513042734874615/ Frame 9809 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/16248513042734874615/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a719ab36590f5ed984818a3df00ef01eb78221a598b04902ee2f2b0d2bf71fb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 22:01:46 GMT
x-content-type-options
nosniff
age
99771
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25168
x-xss-protection
0
last-modified
Tue, 13 Oct 2020 14:12:11 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 03 Dec 2022 22:01:46 GMT
8157428483862788059
tpc.googlesyndication.com/icore_images/ Frame 9809 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/8157428483862788059
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0c0248c11ea32b5473ed1e5e23797342cb05f360f3078eab3231fae6f550e036
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 04:52:55 GMT
x-content-type-options
nosniff
age
334302
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12594
x-xss-protection
0
last-modified
Wed, 11 Aug 2021 07:36:08 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 01 Dec 2022 04:52:55 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/9172168436537344835/ Frame 9809 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/9172168436537344835/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
abf1f225d33040f0846f89566a3908749c61ce74cc565e101432768054a65699
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 28 Nov 2021 03:15:54 GMT
x-content-type-options
nosniff
age
599323
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
104361
x-xss-protection
0
last-modified
Fri, 21 Aug 2020 14:16:27 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Mon, 28 Nov 2022 03:15:54 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/14316058307346410540/ Frame 9809 		71 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/14316058307346410540/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c3f1108df7bbfe540c77dbde63875debd023b17b9fdcee9a9e44e4cf7c1d3b3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 01:16:01 GMT
x-content-type-options
nosniff
age
174516
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
72626
x-xss-protection
0
last-modified
Tue, 23 Nov 2021 00:07:21 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 03 Dec 2022 01:16:01 GMT
3669418499724479651
tpc.googlesyndication.com/icore_images/ Frame 9809 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/3669418499724479651
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2d74ea00c0e8d18b22d73aa5ec7a393f1c14490f5a202f59c7ab7d0be7044e23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 23:15:32 GMT
x-content-type-options
nosniff
age
8945
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13336
x-xss-protection
0
last-modified
Wed, 13 Oct 2021 01:52:14 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 04 Dec 2022 23:15:32 GMT
1242355791437087463
tpc.googlesyndication.com/icore_images/ Frame 9809 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/1242355791437087463
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1bfc2c2ee9af9b35c72c475c8c25d1004f5b43e34b2da6bfd4d99798afe12c9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 19:05:48 GMT
x-content-type-options
nosniff
age
283129
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13982
x-xss-protection
0
last-modified
Thu, 14 Oct 2021 03:01:34 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 01 Dec 2022 19:05:48 GMT
reactive_library_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/ 		148 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/reactive_library_fy2019.js?bust=31063851
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1d48b14f1d9577dfdf1319c531f0383320d168b35caccec7e98322264eebfbb1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
53777
x-xss-protection
0
server
cafe
etag
8438664139149501562
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Sun, 05 Dec 2021 01:44:37 GMT
embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
platform.twitter.com/embed/ Frame CF46 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FC) /
Resource Hash
95c423bf8171e23d66d1b74a7f5bd90ad1806e8a3bea717280f9d71577389230

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FC)
Age
187649
Etag
"243d823d043564092099acd4323c5b02+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
9316
embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
platform.twitter.com/embed/ Frame CF46 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E1) /
Resource Hash
c39f38776508cc2a307bc5b09b86446fb7ed06e2d0e77f0ba25639ed35cab1cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E1)
Age
187649
Etag
"6c690ed926a46ac53582571243a1209b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
1789
iu3
s.amazon-adsystem.com/ Frame CCA6
Redirect Chain
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
304 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
cf26bdbf5ff75c910f2127a46e8d6feb959eeb10eaa979e58112dd0bc0f8a16e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Type
text/html;charset=ISO-8859-1
Content-Length
304
Connection
keep-alive
x-amz-rid
T7KTECMP4E06B6XN0V1A
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

Server
Server
Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Length
0
Connection
keep-alive
x-amz-rid
AMSF86361B4PW58Y2BQF
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()
embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
platform.twitter.com/embed/ Frame 3F7F 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FC) /
Resource Hash
95c423bf8171e23d66d1b74a7f5bd90ad1806e8a3bea717280f9d71577389230

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FC)
Age
187650
Etag
"243d823d043564092099acd4323c5b02+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
9316
embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
platform.twitter.com/embed/ Frame 3F7F 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E1) /
Resource Hash
c39f38776508cc2a307bc5b09b86446fb7ed06e2d0e77f0ba25639ed35cab1cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E1)
Age
187650
Etag
"6c690ed926a46ac53582571243a1209b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
1789
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CSN5zhBmsYd2lDbuexAONwJqIDPXJ3JVmiKWGqtwOoauJ884pEAEgx4P8ASgIYP3oooHwA6ABvu7M-ALIAQaoAwHIAwKqBLUCT9BXa1nySUvoIciHxJNl7tRT3Sa21khstNRyokvn1btrDqXuGQqyCk69JZHEcN7prRuYWF6qXwbGZMbYxIfbLlHaYijrzCEBGt7ixPPEOP8Vv6LcHslDIswLpTFCKfmMceRmhajp4qJDJI5MPlKF5a2o_gIsutqcxChMgYCEUFxfn0H5M1sYZcsodkA23NYnZZrPpsd6H4j75_DBLgG25Ov2VJTqcu8xSVShGvmS_KYW3g7jqMV3rRBEjQH9XcPVM4laDmkcxF0NdNQGGkwpLUavCmpghUTjpws19b3jNx2luVXbc_kzF_g76nOBjx8JHzk02bkJjoVxA-hW0_c2pfZba539wxQmFZ6d9TkzTUYwemJ4Q9-5Edl3HmzeQUTtNYQkJM20zehXB2BY5XEzOZgq324awAT0pfzZ2gOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGN4AHqpGzhwGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDwgiDSCAcIgGEQARgfgAoByAsBwhMGGL7uzPgC2BMM0BUBgBcBshccChoIABIUcHViLTA5MjA4OTkzMDAzOTc4MjMYAA&sigh=-0Z-LtpRY-E&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CxY2NhBmsYd2lDbuexAONwJqIDKXVnbEFjdzCup8Cpp6tjWsQAiDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_Q_MBd0knB6Iu-6MTKcKzTWsgqqNhFZLrLaqZb4Z6qKgBwgqQzhgYFvG2ULkFpgLQHnF8U9kpenmSfzYaA0jtdxGwl48I-GR7O5I_ihTa_FvW7ykbJCTLcGrk3UnLlznv9bIXg8K6jVSmLSGFe26G85P8IYrCZmYc-BJGQj0lRWpVPuj0CAjzaamBBJ8aeJSGNi7OYZw6K-uPmgZosTw3pzVR9SeE5AFt2pvcySEeuljUWC--LdsUT1Ysc_b8GPTCkW_tqHsSoSoHXhhq5KtpFr8qfY3BH46X8NgC-4zfopk1W2XMZNT8ZgNzABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPCCINIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=x5KRdE9bLCo&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CnbhBhBmsYd2lDbuexAONwJqIDKHG1shl_dzTuIUK4Y-l1pcOEAMgx4P8ASgIYP3oooHwA6AB07qD_wPIAQaoAwHIAwKqBKkCT9BsXXPyS0voIciHxJNl7tRT3Sa21khstNRyokvn1btrDqXuGQqyCk69JZHEcN7prRuYWF6qXwbGZMbYxIfbLlHaYijrzCEBGt7ixPPEOP8Vv6LcHslDIswLpTFCKfmMceRmhajp4qJDJI5MPlKF5a2o_gIsutqcxChMgYCEUFxfn0H5M1sYZcsodkA23NYnZZrPpsd6H4j75_DBLgG25Ov2VJSKci0gWlVY8Bl4RuCX3RWarZZ2pxY9iDH8SsU9MFEcDmmcxF1JdNSG2kwpLUavymhghUTjpwk19b3hNx2luVXZc_kxF_g76nODjx8IHzk0zLztYLuRhGvlt_sIBCbcaj1gToSq4dpEVSo70xXz2HaX0lABBdWMclKt3HhLPKYqPDct09jhwATowJLmwgGSBQQIBBgBkgUECAUYBKAGN4AHlcV8qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ8IIg0ggHCIBhEAEYH4AKAcgLAcITBhjTuoP_A9gTDYgUBNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0wOTIwODk5MzAwMzk3ODIzGAA&sigh=1ek71tBuUTk&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CS0muhBmsYd2lDbuexAONwJqIDKXVnbEFjdzCup8Cpp6tjWsQBCDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_Q_MBb0knB6Iu-6MTKcKzTWsgqqNhFZLrLaqZb4Z6qKgBwgqQzhgYFvG2ULkFpgLQHnF8U9kpenmSfzYaA0jtdxGwl48I-GR7O5I_ihTa_FvW7ykbJCTLcGrk3UnLlznv9bIXg8K6jVSmLSGFe26G85P8IYrCZmYc-BJGQj0lRWpVPuj0CAjzaamBBJ8aeJSGNi7OYZw6K-uPmgZosTw3pzVR9SeE5AFt2pvcySEeuljUWC--LdsUT1Ysc_b8GPTCkW_tqHsSoSoHXhhq5KtpFr8qfY3BH46X8NgC-4zfopk1W2XMZNT8ZgNzABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPCCINIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=n-zS3rLPT5U&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CYNhRhBmsYd2lDbuexAONwJqIDOPe_NdjmLyni-MMz-eczLMbEAUgx4P8ASgIYP3oooHwA6AB0onC_wPIAQaoAwHIAwKqBKcCT9AcFt_rUHbRknueq5Nlt5hd1Cajz09lsNhwv07mxKw3Q6nszrG0NUW6adzBcDQywR6EWFqpFhPGPMbYncvVJ1HPey_iyC0DB9vj1eSYdfMX_ePXDM0fftoNszZZNPTaO-xknrn4u-JPKZVaLUXNobf2sQEuspzQyyIF3peDR0Bal0z-OhFceMx2OU0txt02PMHQrosjGZPx7_nMNVphZeh3lpdWuD1Rl01MB9mT_ll9NocNQ32XQPvWU-sLvMY9MBWt-OocxF28gtdGGkzc20WvyGqVc0fjpwnAA7zjNx1QT1bZc_vG4fs76nN2eR0JHznUKmx5boL2MWhd_vnFDCac8HfYTFFzvKGP_bX6nQEmeWud23INHSZND2l-d2xpMr6g5Vl5HsAEm7ql8bEDkgUECAQYAZIFBAgFGASgBjeAB5b2PagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPCCINIIBwiAYRABGB-ACgHICwHCEwYY0onC_wPYEw3QFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=-tSdo4v0074&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CLI4yhBmsYd2lDbuexAONwJqIDPDh3fBm6e6LvoUP4dKDz4EKEAYgx4P8ASgIYP3oooHwA6AB34mLgAPIAQapAgjmwTgoIKo-qAMByAMCqgSxAk_QaHVY8k5L6CHIh8STZe7UU90mttZIbLTUcqJL59W7aw6l7hkKsgpOvSWRxHDe6a0bmFheql8GxmTG2MSH2y5R2mIo68whARre4sTzxDj_Fb-i3B7JQyLMC6UxQin5jHHkZoWo6eKiQySOTD5SheWtqP4CLLranMQoTIGAhFBcX59B-TNbGGXLKHZANtzWJ2Waz6bHeh-I--fwwS4Bzufr1lQlkXb_6l5coby3eY9DfTatCUN95EP71mnsFrweP8VSWPtqWDFeyYHXhu9PKRhFrz9pYHBF41IKNQC-48Iep0xW2Yb6M-L7OR9wg3ocCeo6NSy6CA6BcGPq849lRQ3G2-3Pfk5rqh9TlbWjOS_Uh6TBaMly7fh7erC7K3dsaTC-yNljQh5S-r96YlCEnvZpwATNut3p2QOSBQQIBBgBkgUECAUYBKAGN4AHifb0f6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPCCINIIBwiAYRABGB-ACgHICwHCEwYY34mLgAPYEwzQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=4DO6Y3dzeDw&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=C5coRhBmsYd2lDbuexAONwJqIDKXVnbEFjdzCup8Cpp6tjWsQByDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_Q_MBY0knB6Iu-6MTKcKzTWsgqqNhFZLrLaqZb4Z6qKgBwgqQzhgYFvG2ULkFpgLQHnF8U9kpenmSfzYaA0jtdxGwl48I-GR7O5I_ihTa_FvW7ykbJCTLcGrk3UnLlznv9bIXg8K6jVSmLSGFe26G85P8IYrCZmYc-BJGQj0lRWpVPuj0CAjzaamBBJ8aeJSGNi7OYZw6K-uPmgZosTw3pzVR9SeE5AFt2pvcySEeuljUWC--LdsUT1Ysc_b8GPTCkW_tqHsSoSoHXhhq5KtpFr8qfY3BH46X8NgC-4zfopk1W2XMZNT8ZgNzABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPCCINIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=ncESbu50xtM&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 9809 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Cx3PfhBmsYd2lDbuexAONwJqIDKXVnbEFjdzCup8Cpp6tjWsQCCDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_Q_MBX0knB6Iu-6MTKcKzTWsgqqNhFZLrLaqZb4Z6qKgBwgqQzhgYFvG2ULkFpgLQHnF8U9kpenmSfzYaA0jtdxGwl48I-GR7O5I_ihTa_FvW7ykbJCTLcGrk3UnLlznv9bIXg8K6jVSmLSGFe26G85P8IYrCZmYc-BJGQj0lRWpVPuj0CAjzaamBBJ8aeJSGNi7OYZw6K-uPmgZosTw3pzVR9SeE5AFt2pvcySEeuljUWC--LdsUT1Ysc_b8GPTCkW_tqHsSoSoHXhhq5KtpFr8qfY3BH46X8NgC-4zfopk1W2XMZNT8ZgNzABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEPCCINIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=vf6kXJhzQK0&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638668675816&bpp=5&bdt=427&idt=321&shv=r20211201&mjsv=m202112010101&ptt=9&saldr=aa&abxe=1&correlator=3065587345819&frm=20&pv=2&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063851%2C31063858&oid=2&pvsid=3364310970517454&pem=268&tmod=1449604138&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=IWm76Tx7yD&p=https%3A//www.bleepingcomputer.com&dtd=342
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
async_usersync
ib.adnxs.com/ Frame 8316 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:38 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
083f8f9d-e6d3-4716-8869-64bb737c6ad3
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
o2shim
acds.prod.vidible.tv/ Frame 4872 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=8789babb-2040-41c2-8c48-492019dbef06&pblob=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.207.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-207-71.compute-1.amazonaws.com
Software
/
Resource Hash
d88b2c29e220c0c3c8749198cff8b84349394118272627dda591a6006c838ace

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
content-encoding
gzip
access-control-max-age
3600
access-control-allow-methods
POST, GET, HEAD, PUT, PATCH, DELETE
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-headers
content-length
6640
pixel;r=779957272;labels=keywords.Botnet%2Ckeywords.Emotet%2Ckeywords.Malware%2Ckeywords.TrickBot%2Ckeywords.Trojan%2Ckeywords.Security%2Ckeywords.InfoSec%2Ckeywords.Computer%20Security%2Ctitle.Emo...
pixel.quantserve.com/ 		35 B
210 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=779957272;labels=keywords.Botnet%2Ckeywords.Emotet%2Ckeywords.Malware%2Ckeywords.TrickBot%2Ckeywords.Trojan%2Ckeywords.Security%2Ckeywords.InfoSec%2Ckeywords.Computer%20Security%2Ctitle.Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot%2Ctitle.Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot;rf=0;a=p-UeXruRVtZz7w6;url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F;uht=2;fpan=1;fpa=P0-1916101498-1638668678211;pbc=;ns=0;ce=1;qjs=1;qv=92a3679b-20211110211611;cm=;gdpr=0;ref=;d=bleepingcomputer.com;je=0;sr=1600x1200x24;dst=0;et=1638668678211;tzo=0;ogl=site_name.BleepingComputer%2Clocale.en_us%2Curl.https%3A%2F%2Fwww%252Ebleepingcomputer%252Ecom%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuil%2Ctype.article%2Ctitle.Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot%2Cdescription.The%20Emotet%20malware%20was%20considered%20the%20most%20widely%20spread%20malware%20in%20the%20past%252C%20us%2Cimage.https%3A%2F%2Fwww%252Ebleepstatic%252Ecom%2Fcontent%2Fhl-images%2F2020%2F07%2F28%2FEmotet%252Ejpg%2Cimage%3Asecure_url.https%3A%2F%2Fwww%252Ebleepstatic%252Ecom%2Fcontent%2Fhl-images%2F2020%2F07%2F28%2FEmotet%252Ejpg%2Cimage%3Awidth.1280%2Cimage%3Aheight.500
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:61c0:eb61:c438:2f4e , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		94 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3364310970517454&correlator=1084947904008309&output=ldjh&impl=fifs&eid=31061814%2C31063378%2C31060890&vrg=2021113001&ptt=17&sc=1&sfv=1-0-38&ecs=20211205&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_300x250_300x600_160x600_Right_3%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_1x1&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%7C970x90%7C970x250%2C1x1&ists=1&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_728x90_970x90_970x250_320x50_ATF%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dappnexus_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.91%26hb_adid%3D17725a4ad3a68bf1%26hb_bidder%3Dappnexus%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_728x90_320x50_InContent_1%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dappnexus_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.91%26hb_adid%3D178e535f849f7e6d%26hb_bidder%3Dappnexus%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3Db72a4e%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_2%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dappnexus_300x250%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.91%26hb_adid%3D179ffdfa67e9d26f%26hb_bidder%3Dappnexus%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D65983f%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_3%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dappnexus_300x600%26hb_format%3Dbanner%26hb_size%3D300x600%26hb_pb%3D0.91%26hb_adid%3D1807f00d8cbd5176%26hb_bidder%3Dappnexus%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_728x90_970x90_970x250_320x50_BTF%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dappnexus_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.91%26hb_adid%3D181a95f4c5300e52%26hb_bidder%3Dappnexus%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_1x1%26fs_ad_product%3Dbanner%26fsbid%3D0&eri=1&cust_params=user-agent%3DChrome%26section%3Dnews&cookie=ID%3D464ce9abc714bc84-2282398380ce00f0%3AT%3D1638668676%3ART%3D1638668676%3AS%3DALNI_MbxbBjOmkAbTLmyUtXzPIFFjq2MHg&bc=31&abxe=1&lmt=1637072838&dt=1638668678234&dlt=1638668675390&idt=1164&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C268%2C1082%2C1082%2C436%2C800&adys=271%2C4088%2C1752%2C2504%2C5600%2C6156&adks=960084856%2C4047242158%2C2389526111%2C523518761%2C976516616%2C2635258439&ucis=2%7C3%7C4%7C5%7C6%7C7&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x280%7C834x90%7C306x600%7C306x600%7C1200x250%7C1600x6180&msz=1170x250%7C834x90%7C306x600%7C306x600%7C1170x250%7C1600x0&ga_vid=335997328.1638668676&ga_sid=1638668676&ga_hid=231263131&ga_fc=true&fws=4%2C4%2C4%2C516%2C4%2C4&ohw=1170%2C834%2C306%2C306%2C1170%2C1600&btvi=0%7C1%7C2%7C3%7C4%7C5&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021113001.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
7ca91b7f677742077ad7bc966c790a156fb2f9a50de5c94ec108e459da932db3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13184
x-xss-protection
0
google-lineitem-id
5334037887,5334037887,5334037887,5334037887,5334037887,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138307543351,138307157297,138307543357,138307543369,138307543366,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame 9809 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b5071e0d9026ad157e994a31f51bc7d64c2f7ea6b342cb054f6ea8407a342d34

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
882.json
id5-sync.com/g/v2/ 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/882.json
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.195.5.234 , France, ASN16276 (OVH, FR),
Reverse DNS
p36.id5-sync.com
Software
/
Resource Hash
61240b59a6b32dc70071273d884dbbc0a432a903465be52987c74fd01b61597d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:44:29 GMT
Vary
Origin
P3P
CP="CAO PSA OUR"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Access-Control-Allow-Credentials
true
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
Transfer-Encoding
chunked
c
c.pub.network/ 		36 B
329 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
controltag.js.a1705c5ac5f06cf0c202ff70908fc042
cdn.krxd.net/ctjs/ 		259 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/womptv2nm.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date
Sun, 05 Dec 2021 01:44:38 GMT
content-encoding
gzip
age
10761988
x-amz-server-side-encryption
AES256
x-cache
HIT
x-cache-hits
5667502
content-length
84509
x-served-by
cache-yul12826-YUL
last-modified
Mon, 02 Aug 2021 12:06:17 GMT
x-timer
S1638668678.403105,VS0,VE0
etag
"a1705c5ac5f06cf0c202ff70908fc042"
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=315360000
accept-ranges
bytes
expires
Thu, 31 Jul 2031 12:06:16 GMT
integrator.js
adservice.google.ca/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/ Frame E98F 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 18:08:53 GMT
expires
Sat, 18 Dec 2021 18:08:53 GMT
content-type
text/html; charset=UTF-8
etag
6406113418471942685
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4879
x-xss-protection
0
age
27345
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/ Frame 9C49 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 18:08:53 GMT
expires
Sat, 18 Dec 2021 18:08:53 GMT
content-type
text/html; charset=UTF-8
etag
6406113418471942685
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4879
x-xss-protection
0
age
27345
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9809 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 01:28:42 GMT
x-content-type-options
nosniff
age
173756
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 03 Dec 2022 01:28:42 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9809 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:09:49 GMT
x-content-type-options
nosniff
age
5689
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Mon, 05 Dec 2022 00:09:49 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9809 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 04:56:13 GMT
x-content-type-options
nosniff
age
334105
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 01 Dec 2022 04:56:13 GMT
container.html
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5C28 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Sun, 05 Dec 2021 01:44:37 GMT
expires
Mon, 05 Dec 2022 01:44:37 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pr
s.amazon-adsystem.com/v3/ Frame 0303 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
d2abe9d5f7eec7dfc53021326811dd6770437e66cd21623e7f92eac2bf95aa5a
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Type
text/html;charset=ISO-8859-1
Content-Length
2355
Connection
keep-alive
x-amz-rid
1MEX0AD2Q5JFDDQ9RW29
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()
embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
platform.twitter.com/embed/ Frame CF46 		383 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/80C2) /
Resource Hash
7abdd47254800f35ffef0fc434fa7fcf432e13651b27670b2e6f8e08143d4b00

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/80C2)
Age
187650
Etag
"28a37f9b17808aa66f17b1c227be059e+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
96013
embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
platform.twitter.com/embed/ Frame CF46 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E0) /
Resource Hash
0e8670554443313b972c10ae1a34baeb408d060fc5e82c6a358f77d7e98dd15e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E0)
Age
187647
Etag
"c247e426d2ec154064a87aaff54defce+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5857
embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
platform.twitter.com/embed/ Frame CF46 		66 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FE) /
Resource Hash
6cbf3d5198e3c67803ca9868b5ee9c2c464f2e6ddcce9cef64ed608c5c57949f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FE)
Age
187650
Etag
"97f699efb69f30d41bbda8690575fe25+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
16017
embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
platform.twitter.com/embed/ Frame 3F7F 		383 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/80C2) /
Resource Hash
7abdd47254800f35ffef0fc434fa7fcf432e13651b27670b2e6f8e08143d4b00

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/80C2)
Age
187650
Etag
"28a37f9b17808aa66f17b1c227be059e+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
96013
embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
platform.twitter.com/embed/ Frame 3F7F 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E0) /
Resource Hash
0e8670554443313b972c10ae1a34baeb408d060fc5e82c6a358f77d7e98dd15e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E0)
Age
187647
Etag
"c247e426d2ec154064a87aaff54defce+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5857
embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
platform.twitter.com/embed/ Frame 3F7F 		66 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:de:468:2285:c1:4a3 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FE) /
Resource Hash
6cbf3d5198e3c67803ca9868b5ee9c2c464f2e6ddcce9cef64ed608c5c57949f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=4dc41c59a4b54834076ebfc3a17b36e5148dc946&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FE)
Age
187650
Etag
"97f699efb69f30d41bbda8690575fe25+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
16017
0.js
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/ Frame 4872 		319 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Requested by
Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=8789babb-2040-41c2-8c48-492019dbef06&pblob=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1001 Ashburn, United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

ats-carp-promotion
1
date
Mon, 29 Nov 2021 16:25:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465526
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-length
104909
x-amz-id-2
ViDU7qxIVXCQ1OoL+wnEuf7bcOjIs2T7ni4ZpbYjPgnIAOe5CwvGhyqrgU0nSXPjJWD8zviCczc=
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 29 Oct 2021 12:07:18 GMT
server
ATS
etag
"ad866575d644f8b5c5d7a56ff730d7e3-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-request-id
XVSF9HDPN0WNYG5D
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=1209600
x-amz-version-id
null
accept-ranges
bytes
content-type
application/javascript
impression.gif
trk.vidible.tv/trk/ Frame 4872 		43 B
246 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.82&ifr=true&cb=0.7536794135574767&pt=o2unit&sid=1a250248-26f6-44b4-ab7c-25bf4a5142f0&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:38 GMT
proxy.3d2100fd7107262ecb55ce6847f01fa5.html
cdn.krxd.net/partnerjs/xdi/ Frame 69F7 		805 B
828 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

last-modified
Tue, 21 Feb 2017 17:50:54 GMT
etag
"3d2100fd7107262ecb55ce6847f01fa5"
cache-control
public, max-age=315360000
expires
Fri, 19 Feb 2027 17:50:50 GMT
content-type
text/html
x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
content-encoding
gzip
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:44:38 GMT
via
1.1 varnish
age
15519198
x-served-by
cache-yul12826-YUL
x-cache
HIT
x-cache-hits
1691666
x-timer
S1638668679.688571,VS0,VE0
vary
Accept-Encoding
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length
525
css2
fonts.googleapis.com/ Frame E98F 		4 KB
634 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:31:17 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:44:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:44:38 GMT
feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E98F 		205 B
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 22:40:56 GMT
x-content-type-options
nosniff
age
443022
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 29 Nov 2022 22:40:56 GMT
settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E98F 		604 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:11:42 GMT
x-content-type-options
nosniff
age
5576
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
604
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Mon, 05 Dec 2022 00:11:42 GMT
interstitial_ad_frame_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame E98F 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/interstitial_ad_frame_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1d71682fbb31fc64ba19097a9eb389593ba1bf9f9f913bef6eaf563eb08c2a7a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:13:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5439
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8210
x-xss-protection
0
server
cafe
etag
6499249944067270656
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 00:13:59 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame 9C49 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CH9KihBmsYbqTDozyMZj5uoAJ1qWtl2bl4LLj7g771fT9CBABIMeD_AFg_eiigfADoAGPs46_A8gBAqgDAcgDyQSqBK0CT9CEbhfBkM_o3Zq-WoaOXiB-d-r2sqGPUNNXMN4JEi7U9sVZD4LoHYwLa9xQ9-zCzDKsBWhrbp9k-I_IS1zikgiUVKvm27fKDeUbJOPyiJb6V_gPqoFnx5_0OLZtQu-6onAdNqiEk5ga9u5m8KSA6ipgeyTBPv6_uOjDN-ILXEu31D8AI553cc_ftQJ_C4NwtMz_n69sdT0JIKaMMZHrq2xI9KhOiVSOd1MhY5qvV75ra2O2tIlmRaC7to9RCOmQ-tnMU_bfrZa6O6Iz9yYzzNVtzh0YoWWDcrHKfx55DsZCk0F6EZMqNaZIzeds6Tt22kFiwrh5uKi_aeMx-G_q4kqGpY3RwQd3I0A1o-T8eHWE8xB7FYtaEbl7lRTXlPEWnS09R8eseYWUblf5isAEyZmY8uYDoAYCgAetpL20AagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEENywKdIIBwiAYRABGB-ACgHICwHYEwPQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=8VjB4oQTbA0&uach_m=[UACH]
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 9C49 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:40:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
224
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7857
x-xss-protection
0
server
cafe
etag
2255741555227857113
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:40:54 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 9C49 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:43:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
68
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:43:30 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9C49 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:38 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 9C49 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
33
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:44:05 GMT
one_click_handler_one_afma_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 9C49 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/one_click_handler_one_afma_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e11652e7b04cdcc9c0bc7948055c05aaf8f7c066e6059d52f9b186c55368cb9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 10:40:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
54242
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11392
x-xss-protection
0
server
cafe
etag
7769099329773015066
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sat, 18 Dec 2021 10:40:36 GMT
1967654676753962687
tpc.googlesyndication.com/simgad/ Frame 9C49 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1967654676753962687?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnuVNebDh3_fnO8Vo0zDLsrG7kCQQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
abd3d72d03f5b373f219487bd1c6823c71f1e7015b5540c4ec8ef0836a54924a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 06:21:09 GMT
x-content-type-options
nosniff
age
329009
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6179
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 12:21:12 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 01 Dec 2022 06:21:09 GMT
ecm3
s.amazon-adsystem.com/ Frame 0303
Redirect Chain
  • https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D
  • https://s.amazon-adsystem.com/ecm3?id=DBE6805D465846A3966128D6AD5D95CA&ex=simpli.fi&status=ok
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=DBE6805D465846A3966128D6AD5D95CA&ex=simpli.fi&status=ok
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:38 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
JQPSXNACV6QNTTNJP0XP
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Sun, 05 Dec 2021 01:44:38 GMT
x-content-type-options
nosniff
server
nginx
location
https://s.amazon-adsystem.com/ecm3?id=DBE6805D465846A3966128D6AD5D95CA&ex=simpli.fi&status=ok
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Sat, 04 Dec 2021 01:44:38 GMT
usermatch
ssum-sec.casalemedia.com/ Frame 9784 		1 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
be2b278110fd329ff68ecfc79b0e3b65c817f3f46126588329b1ec48b1f839e4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
45|241|230|39|73|5|130|64
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1519
Expires
Sun, 05 Dec 2021 01:44:38 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:38 GMT
Connection
keep-alive
/
match.sharethrough.com/jwumXNuB/v1/ Frame 6F35 		427 B
613 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-233-74-164.compute-1.amazonaws.com
Software
/
Resource Hash
1fbd3c6688d8fa927d73b2b6732d7dc1285972b6d6d4684fe811a3284f7b5a58

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
content-length
427
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 1047 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=29487
expires
Sun, 05 Dec 2021 09:56:05 GMT
date
Sun, 05 Dec 2021 01:44:38 GMT
vary
Accept-Encoding
tamptsync
sync-amz.ads.yieldmo.com/ Frame 9F6A 		886 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.101.253.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-75-101-253-183.compute-1.amazonaws.com
Software
/
Resource Hash
cd8a0611fc79f13600be6c8fa54956873c4b847ff63ecb69ae767fce13837b8b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
usync.html
eus.rubiconproject.com/ Frame 9F5C 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:44:38 GMT
Connection
keep-alive
Vary
Accept-Encoding
ecm3
s.amazon-adsystem.com/ Frame 78E1
Redirect Chain
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8861207277885483119&gdpr=0&gdpr_consent=
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8861207277885483119&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:44:39 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
NHC993R8Y89RB8B532C0
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

date
Sun, 05 Dec 2021 01:44:38 GMT
content-length
0
location
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=8861207277885483119&gdpr=0&gdpr_consent=
ecm3
s.amazon-adsystem.com/ Frame F929
Redirect Chain
  • https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
  • https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOX6sleXF7_9ReCQDqXLd6m1O6SQ9WrsHmXrIgsQ
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOX6sleXF7_9ReCQDqXLd6m1O6SQ9WrsHmXrIgsQ
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:44:39 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
KKT69D3R8ZRH2JZAVAMS
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

P3P
CP="CAO PSA OUR"
Location
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOX6sleXF7_9ReCQDqXLd6m1O6SQ9WrsHmXrIgsQ
Transfer-Encoding
chunked
Date
Sun, 05 Dec 2021 01:44:29 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
ecm3
s.amazon-adsystem.com/ Frame 19A7
Redirect Chain
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=b865590ae36122f&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdXSNZEOKKQNisyUVAAAAAAA&expiration=1638755079&is_secure=true
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdXSNZEOKKQNisyUVAAAAAAA&expiration=1638755079&is_secure=true
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:44:39 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
8DV5BZHDRB3XBR6QFBA7
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:44:39 GMT
content-length
0
cache-control
no-cache, private, max-age=0, no-store
expires
0
pragma
no-cache
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdXSNZEOKKQNisyUVAAAAAAA&expiration=1638755079&is_secure=true
amazon
ap.lijit.com/beacon/ Frame 7E12
Redirect Chain
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.114.136 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
341cd09c496e0174d4337fa85c8861bf3844ec1b9298ac902ca4a03f10af9730

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
nginx
Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Vary
Accept-Encoding
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
X-Powered-By
raptor
Content-Encoding
gzip
X-Sovrn-Pod
ad_ap5ewr1

Redirect headers

Server
nginx
Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap5ewr1
ecm3
s.amazon-adsystem.com/ Frame 46CE
Redirect Chain
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=5223479661490903678
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=5223479661490903678
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:44:38 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
C26A845M7X39YXDFMWWE
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

date
Sun, 05 Dec 2021 01:44:38 GMT
content-length
0
location
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=5223479661490903678
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
9427dd0d-835c-471c-a5db-ab01ae8a681c
consumer.krxd.net/consent/get/ 		249 B
438 B 		Script
General
Check archive.org
Download Go to
Full URL
https://consumer.krxd.net/consent/get/9427dd0d-835c-471c-a5db-ab01ae8a681c?idt=device&dt=kxcookie&callback=Krux.ns.investingchannelinc.kxjsonp_consent_get_0
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5195609afbc1fca03f3200b50d97a90a8eb0e4652108db990a1aa9a1c9f7a0af

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
via
1.1 varnish
age
0
x-served-by
consumer-a019-ash-prod.krxd.net, cache-yul12824-YUL
vary
Accept-Encoding
x-cache
MISS, MISS
content-type
text/javascript; charset=UTF-8
content-encoding
gzip
cache-control
max-age=1800
x-age
0
accept-ranges
bytes
x-timer
S1638668679.834722,VS0,VE16
content-length
199
x-cache-hits
0, 0
8.gif
id5-sync.com/i/882/ 		79 B
79 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id5-sync.com/i/882/8.gif?id5id=ID5*FIAfvhFjd4g_s60lEMFSGxJ_KGodchv-GGaTFxB6ckAA5QHxpDu04XRDy1_qhK6jAOhbuDZa_jqAQYm3me02SQDpjo3p-l9G1m7nQ5NJ8FQA6q9pz4jYfBYJ43l3TUGMAOtc8CkCulq7A9b3BXqTPQDtRyiIKmN99eqh_EOAAOIA91t72dytSY_SCB36povLAPl8L3bQMHL1gfEfZhpDOQD7Kfi1QqyinOk61gYyYmQA_o7njAua1RiCswmZkpPUAQGxgSHwyiVMi17ZCipt6wEEeYBcjBH-XGY5KC2ePNIBCN33d7Ml2xXxJxnz1n6aAQsd41-re8tOd560CPRs7gEOWDAVDxI0f7WQG1YB9KIBEcv0gdd0rFMMy7yyU3IUARTh9VGIZwteuk8oNHYYewFCa86aBHbmODmLCT3V_gIBRJIMfAOvIMONTYb8Xa9-AUefQqQQzq5PwibDYfHDjgFOTpehPv7DwXod5DfA-0gBUZzRz4ZG6SrNpvLCnjKn&o=api&gdpr_consent=undefined&gdpr=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.195.5.234 , France, ASN16276 (OVH, FR),
Reverse DNS
p36.id5-sync.com
Software
/
Resource Hash
06ecc1573d3bd555fe29b67a1f5f9a4f560413c5d3a979eb7ad1960866ddbad8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Date
Sun, 05 Dec 2021 01:44:29 GMT
Transfer-Encoding
chunked
Content-Type
text/html;charset=utf-8
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame 5C28 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102635
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
VRIAs2T6wCJfapO414CZqdlB7LSWx_JV8ph6plgOkAJgUPdkNffYjQ==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame 5C28 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1444717
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
ngZC0oD2OqobV-Igfa1uTm-KTlW-eldC8YZOsFzcQFodnzBz1QkQTA==
gen_204
pagead2.googlesyndication.com/pagead/ Frame 5C28 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BoSmdYaPIb1yeRuLpjnLnu_MDZyBeod7q8MLJgeNz_tuopTlF1pc7W4oQuML89uCdZ2NMlrKctY_5pZR3wCd_i_ND3uolUg1DqJAoIXgjXXvEQeIY
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 5C28 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:43:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:43:30 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5C28 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:39 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 5C28 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
34
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:44:05 GMT
tweet
cdn.syndication.twimg.com/ Frame CF46 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.syndication.twimg.com/tweet?features=tfw_experiments_cookie_expiration%3A1209600%3Btfw_horizon_tweet_embed_9555%3Ahte%3Btfw_space_card%3Aoff&id=1460302706954981385&lang=en
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
tsa_b / Express
Resource Hash
0f35719d73ced9e0bc4385a027050b3ecf4fe24b70fe1e7b6337422e342e633a
Security Headers
Name Value
Content-Security-Policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding
gzip
etag
W/"576-knqBWYtZ2BjxGtSHrsAKuD67/GI"
x-powered-by
Express
access-control-allow-methods
GET
strict-transport-security
max-age=631138519
x-xss-protection
0
x-response-time
38
server
tsa_b
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Origin, Accept-Encoding
x-tw-cdn
VZ, VZ
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=60
access-control-allow-credentials
true
x-connection-hash
5b17d5f29ebd5c9d8548d9ef56cdf455ed3102ba5feae476eca42ac21d9329cb
x-content-type-options
nosniff
access-contol-allow-origin
platform.twitter.com
tweet
cdn.syndication.twimg.com/ Frame 3F7F 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.syndication.twimg.com/tweet?features=tfw_experiments_cookie_expiration%3A1209600%3Btfw_horizon_tweet_embed_9555%3Ahte%3Btfw_space_card%3Aoff&id=1460308766767915013&lang=en
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
tsa_b / Express
Resource Hash
1c2529c4a862e2aeb90919c7185507f674d87b517c404964d4ce831e13bca0dd
Security Headers
Name Value
Content-Security-Policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding
gzip
etag
W/"f9d-UlyqDM2nXb92rZtUhXDKQBG4fEc"
x-powered-by
Express
access-control-allow-methods
GET
strict-transport-security
max-age=631138519
x-xss-protection
0
x-response-time
86
server
tsa_b
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Origin, Accept-Encoding
x-tw-cdn
VZ, VZ
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=60
access-control-allow-credentials
true
x-connection-hash
c81d24d17e6568fadf9755f39bf67ded3e925bd9b2fa84ae5c7d30e2d51583f0
x-content-type-options
nosniff
access-contol-allow-origin
platform.twitter.com
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
womptv2nm.js
cdn.krxd.net/controltag/ Frame 69F7 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/controltag/womptv2nm.js
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e1023fc5b7b2cb762dd4ad14fcf4787fa945fca4a37518cd0d6b411c248dc201

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date
Sun, 05 Dec 2021 01:44:38 GMT
via
1.1 varnish, 1.1 varnish
age
1077
x-cache
MISS, HIT, HIT
x-app-cache
HIT
x-age
0
content-encoding
gzip
content-length
3716
x-served-by
config-service-a005-ash-prod.krxd.net, cache-bwi5155-BWI, cache-yul12826-YUL
x-response-time
1
x-do-esi
esi
x-timer
S1638668679.916628,VS0,VE0
etag
"fa213313d0f749c73627133b4ab4942a6489b2c7"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=1200
accept-ranges
bytes
x-cache-hits
0, 4, 757
moatapi.js
z.moatads.com/aolvidibleapi29384728347/ Frame 5F91 		133 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
content-encoding
gzip
last-modified
Tue, 25 Feb 2020 18:37:38 GMT
server
AmazonS3
x-amz-request-id
173F0BEA92CD9AC6
etag
"d678022569896f7b7293494e3a69c8c7"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11215
accept-ranges
bytes
content-length
44266
x-amz-id-2
RklxkPdiYk8GhMpdx5iMxA7DvkiGo6tkMATS2fpRD27gNLLlz56AlUBtVoddESPwbLn/omOVHYo=
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 4872 		249 B
0 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668676602&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
text/javascript, application/json, text/html, application/xml, text/xml, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
server
adaptv/1.0
content-type
text/xml
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
192
expires
0
display.gif
trk.vidible.tv/trk/ Frame 4872 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=1a250248-26f6-44b4-ab7c-25bf4a5142f0&vvuid=ecc4d890-33ec-4c1d-bd3f-4de6c0477f53&orgId=28949&plcid=1279691&vrid=8789babb-2040-41c2-8c48-492019dbef06&ab=0&dt=314&h=469&spaceid=793604934&w=834&cb=0.48790878921867553
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:38 GMT
ad-request.gif
trk.vidible.tv/trk/ Frame 4872 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=1a250248-26f6-44b4-ab7c-25bf4a5142f0&vvuid=ecc4d890-33ec-4c1d-bd3f-4de6c0477f53&orgId=28949&plcid=1279691&vrid=8789babb-2040-41c2-8c48-492019dbef06&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.501596446358973
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:38 GMT
ad-engine-request.gif
trk.vidible.tv/trk/ Frame 4872 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=1a250248-26f6-44b4-ab7c-25bf4a5142f0&vvuid=ecc4d890-33ec-4c1d-bd3f-4de6c0477f53&orgId=28949&plcid=1279691&vrid=8789babb-2040-41c2-8c48-492019dbef06&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=469&cb=0.680079260184087
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:38 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 0A31 		143 B
163 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Sun, 05 Dec 2021 01:34:41 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
598
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 9C49 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5403fee0bcc90c867c9ea4e521593432aea7c30ac3b2779ba0ce120be17c931c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
usync.js
eus.rubiconproject.com/ Frame 9F5C 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
ea69b75b81243d7429f2762349a7b95e0fc43ca337db14df218371e656286357

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:39 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17699
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:38 GMT
css
fonts.googleapis.com/ Frame 3D37 		3 KB
579 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:39:06 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:44:39 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:44:39 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3D37 		1 KB
890 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:37:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
456
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
853
x-xss-protection
0
server
cafe
etag
7170004918125193417
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:37:03 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 3D37 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:40:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
225
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7857
x-xss-protection
0
server
cafe
etag
2255741555227857113
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:40:54 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3D37 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:43:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
69
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:43:30 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 3D37 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:39 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3D37 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
34
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:44:05 GMT
163b3e9c260ab6fd774ac5b5c6fd1d76.js
www.gstatic.com/mysidia/ Frame 3D37 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 00:38:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
349558
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11360
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 04:29:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 01 Mar 2022 00:38:41 GMT
crum
dsum-sec.casalemedia.com/ Frame 9784
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YawZhBbaf-sLobsSgmffIQAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:39 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 9784 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
SGX9GSMX0A1B30KFXEAQ
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame 9784
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&gdpr_consent=&us_privacy=&gdpr=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:39 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
342
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 9784
Redirect Chain
  • https://match.adsrvr.org/track/cmf/casale
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&expiration=1641260679&gdpr=0&gdpr_consent=
43 B
1007 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&expiration=1641260679&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:39 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&expiration=1641260679&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
323
YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 9784 		43 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB?gdpr_consent=&us_privacy=&gdpr=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
ix
ad4m.at/ad/sim/ Frame 9784 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad4m.at/ad/sim/ix
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
ie
match.prod.bidr.io/cookie-sync/ Frame 9784 		43 B
430 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.prod.bidr.io/cookie-sync/ie
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.233.68.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-233-68-37.compute-1.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control
no-cache, must-revalidate
Connection
keep-alive
content-type
image/gif
Content-Length
43
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 9784
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&partner_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D64...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&partner_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_i...
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&expiration=1641260679
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&expiration=1641260679
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:41 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:41 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&expiration=1641260679
date
Sun, 05 Dec 2021 01:44:41 GMT
via
1.1 google
alt-svc
clear
content-length
0
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
ecm3
s.amazon-adsystem.com/ Frame 9784 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=index.com&id=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
J6QHGYTHFFB62SCTFNS0
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 9F6A 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=g67686cd09a053cd6899
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
8G78MYAM13E1EWXV5GNT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
ib.adnxs.com/&https://ads.yieldmo.com/v000/ Frame 9F6A
Redirect Chain
  • https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
  • https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=8987304192775495297&pn_id=an
0
585 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=8987304192775495297&pn_id=an
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
HTTP/1.1
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
3b084a3b-40b6-453a-a345-bac88b19bec7
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
c9e7719c-5f41-4f6e-9732-c629939a9d3b
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
&https://ads.yieldmo.com/v000/sync?userid=8987304192775495297&pn_id=an
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
ads.yieldmo.com/ Frame 9F6A
Redirect Chain
  • https://x.bidswitch.net/sync?&ssp=yieldmo
  • https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=yieldmo&ssp_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
  • https://x.bidswitch.net/sync?dsp_id=74&&user_id=171119515&expires=5&ssp=yieldmo
  • https://ads.yieldmo.com/sync?userid=e844459d-39b0-402c-bf5a-7640e7a8c718&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
43 B
638 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?userid=e844459d-39b0-402c-bf5a-7640e7a8c718&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
35.169.74.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-74-7.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

Location
//ads.yieldmo.com/sync?userid=e844459d-39b0-402c-bf5a-7640e7a8c718&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Date
Sun, 05 Dec 2021 01:44:40 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sync
ads.yieldmo.com/v000/ Frame 9F6A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo
  • https://ads.yieldmo.com/v000/sync?tdid=7de5ca57-c954-4db1-bc90-ae26323dfac5
43 B
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?tdid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
35.169.74.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-74-7.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ads.yieldmo.com/v000/sync?tdid=7de5ca57-c954-4db1-bc90-ae26323dfac5
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
181
sync
ads.yieldmo.com/ Frame 9F6A
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?&nid=21
  • https://ads.yieldmo.com/sync?pn_id=stk&userid=fjjYmhumTpxKx2Vf1I9_oCV4zbY
43 B
326 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?pn_id=stk&userid=fjjYmhumTpxKx2Vf1I9_oCV4zbY
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
35.169.74.7 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-74-7.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

Location
https://ads.yieldmo.com/sync?pn_id=stk&userid=fjjYmhumTpxKx2Vf1I9_oCV4zbY
Date
Sun, 05 Dec 2021 01:44:39 GMT
Connection
keep-alive
Content-Length
100
Content-Type
text/html; charset=utf-8
sync
sync-pp.ads.yieldmo.com/ Frame 9F6A
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?&pid=561118&ev=1&rurl=https://sync-pp.ads.yieldmo.com/sync?userid=%%VGUID%%&pn_id=pp
  • https://sync-pp.ads.yieldmo.com/sync?userid=355Kb29h0Wqs&ev=1&pn_id=pp&pid=561118
43 B
528 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-pp.ads.yieldmo.com/sync?userid=355Kb29h0Wqs&ev=1&pn_id=pp&pid=561118
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
75.101.253.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-75-101-253-183.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-CA
location
https://sync-pp.ads.yieldmo.com/sync?userid=355Kb29h0Wqs&ev=1&pn_id=pp&pid=561118
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-544c4f9c45-5hsbq
expires
-1
ecm3
s.amazon-adsystem.com/ Frame 6F35 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=99fee750-0d85-4cdf-8744-4e5ad497d21e
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
D5VT98T0HFAT1M26DNS8
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
v1
match.sharethrough.com/sync/ Frame 6F35
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=18694
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL0RE8-3-ILJG
68 B
262 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL0RE8-3-ILJG
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-233-74-164.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-length
68
content-type
image/png

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL0RE8-3-ILJG
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
f72efbd84733ea5ba734e4e8fe0395a3
Expires
0
v1
match.sharethrough.com/sync/ Frame 6F35
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
68 B
262 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-233-74-164.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
323
v1
match.sharethrough.com/sync/ Frame 6F35
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
68 B
262 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-233-74-164.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
323
v1
match.sharethrough.com/sync/ Frame 6F35
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
  • https://bttrack.com/pixel/cookiesync?source=d0afdff5-c51e-4a8d-b07b-b52a29015170&secure=1
  • https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=72c611fb-f28e-4ff5-b0be-f4db517a6bb3
68 B
262 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=72c611fb-f28e-4ff5-b0be-f4db517a6bb3
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-233-74-164.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
content-length
68
content-type
image/png

Redirect headers

X-ServerName
Track001-dc3
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Location
https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=72c611fb-f28e-4ff5-b0be-f4db517a6bb3
Cache-Control
private,no-cache
Content-Type
text/html; charset=utf-8
Content-Length
246
Expires
-1
jot
syndication.twitter.com/i/ Frame CF46 		43 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638668679242%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460302706954981385%22%5D%2C%22item_details%22%3A%7B%221460302706954981385%22%3A%7B%22item_type%22%3A0%7D%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.8 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
13
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:44:39 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
528f450bba4fb31a3de58ff7ff236742065a5b066f29e33d0cd1d5725236bd97
x-transaction
a154f03399540500
expires
Tue, 31 Mar 1981 05:00:00 GMT
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame F0A3 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102636
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
7hZfLqLZfqcnjEpJqHwHJlss_G1j8ERExTtiFFKIDNFpaIE8JmZpfw==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame F0A3 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1444718
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
DAGgJc37_cV9uPVabDxQ0Q0L-nTwgHwizVMr_Qpx-69TAARRW0m6WA==
prebid-universal-creative.js
a.pub.network/core/ Frame F0A3 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-universal-creative.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Mv5J2Q==, md5=qhZ9KavhQaYEZZQvkPC+nQ==
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17563
x-guploader-uploadid
ADPycdsekqr_XRLaJHWG_rCg_D2pScsUPeqoeAM_N2cnjtR_Bc1P6OK0aSlVtjMxLNFFviiiA6nxI7e_5Gzxgamy595TKPuepQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Tue, 28 Sep 2021 15:52:36 GMT
server
cloudflare
etag
W/"aa167d29abe141a60465942f90f0be9d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QYEOaOH%2Fzt0NIgUbI9Gxid51VqPtdSdazfjUpAR8jzWEDqid8emexxh9fLr%2Bx6CAfsI%2F5Wh%2BX%2BhQaQNggY%2FnxUZtCo3q9PhGoRu8ZHT%2BauEqwCV%2FJ3WVJ4r87rpb%2FGKr4qUlBtxYFOg7Uyg%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1632844356805025
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
26661
cf-ray
6b89972dde1e713e-YUL
expires
Sat, 04 Dec 2021 21:51:56 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F0A3 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:39 GMT
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame 5491 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102636
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
RtL0YgBG1lG6rsQOCW-_7i_iB8vCOSX3ynLzGYaypfIj25RgCmUPEg==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame 5491 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1444718
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
ORCmIjsLLabKGlVTqRl6-bCNcEwkqCLWcsYtguo3asimM--C9wp-uA==
prebid-universal-creative.js
a.pub.network/core/ Frame 5491 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-universal-creative.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Mv5J2Q==, md5=qhZ9KavhQaYEZZQvkPC+nQ==
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17563
x-guploader-uploadid
ADPycdsekqr_XRLaJHWG_rCg_D2pScsUPeqoeAM_N2cnjtR_Bc1P6OK0aSlVtjMxLNFFviiiA6nxI7e_5Gzxgamy595TKPuepQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Tue, 28 Sep 2021 15:52:36 GMT
server
cloudflare
etag
W/"aa167d29abe141a60465942f90f0be9d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QYAI9V6JESh2nby49%2Fq7Z%2BZlp%2BHn6TECIFc3h8H%2FbD5%2BxjvK3%2FocFMitjGASP5ex9R1%2BeNpwyIzhcAWwe%2BFmdaZEMB5SOtAOg4vkjrPoqcy68HqDCtlKZcXk%2FHHM8VcPbVb1XqZBUYCvOdA%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1632844356805025
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
26661
cf-ray
6b89972e0e8b713e-YUL
expires
Sat, 04 Dec 2021 21:51:56 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5491 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:39 GMT
demand-source
d.pub.network/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
content-length
0
via
1.1 google
alt-svc
clear
demand-source
d.pub.network/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
content-length
0
via
1.1 google
alt-svc
clear
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame 08B5 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102636
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
gEAbjS2IZISaWZHCLR01jmpjsWgzgWFWJ5QLQDsf2H1YSMoWcHOA8Q==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame 08B5 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1444718
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
dOhm0WhcXcshPwkGfDo__RFOnsTKZ6mebHest3ZqvMaF-TSZq1z6SQ==
prebid-universal-creative.js
a.pub.network/core/ Frame 08B5 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-universal-creative.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Mv5J2Q==, md5=qhZ9KavhQaYEZZQvkPC+nQ==
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17563
x-guploader-uploadid
ADPycdsekqr_XRLaJHWG_rCg_D2pScsUPeqoeAM_N2cnjtR_Bc1P6OK0aSlVtjMxLNFFviiiA6nxI7e_5Gzxgamy595TKPuepQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Tue, 28 Sep 2021 15:52:36 GMT
server
cloudflare
etag
W/"aa167d29abe141a60465942f90f0be9d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oDsLsICJE3aP93HHAtcPbQJGqA83o5XLbRBEFd2a3UHHAzTy348gPAWoQa1yiPi3Uiw3Ae7Z%2BuBOOlGYkXVz6mmthI32qVIlgc0wQIZhYw6REGh%2FA7%2Fp5UcPu3VNRuFty4AztDKmxdZXbpk%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1632844356805025
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
26661
cf-ray
6b89972e3ec3713e-YUL
expires
Sat, 04 Dec 2021 21:51:56 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 08B5 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:39 GMT
demand-source
d.pub.network/ 		61 B
271 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
42050a0fdef878dc249fc51498e5c67146a2f9becbef81c1e5edbe32d85435ca

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
demand-source
d.pub.network/ 		61 B
234 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
42050a0fdef878dc249fc51498e5c67146a2f9becbef81c1e5edbe32d85435ca

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
async_usersync
ib.adnxs.com/ Frame 8316 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
224d2059-479d-4370-8934-977124782e56
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame 4B4A 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156592&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dcee0a083e7aa41ee905839ad8069ffb9%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:38 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
ecm3
s.amazon-adsystem.com/ Frame 7E12 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=37e1e7f6223a458ed25ab69d&ex=sovrn.com&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
G00T65Q18YPKV5J1NRKM
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame 7E12
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
  • https://ce.lijit.com/merge?pid=86&3pid=nxh61y00tA73Nuy4zCQ9&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
43 B
846 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=86&3pid=nxh61y00tA73Nuy4zCQ9&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.49 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap1dca1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=86&3pid=nxh61y00tA73Nuy4zCQ9&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT, Sun, 05 Dec 2021 01:44:39 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame 7E12
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=87&3pid=445d1fc1-46d4-494d-842f-cfe15cd6e197
43 B
862 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=87&3pid=445d1fc1-46d4-494d-842f-cfe15cd6e197
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.49 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap1dca1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
//ce.lijit.com/merge?pid=87&3pid=445d1fc1-46d4-494d-842f-cfe15cd6e197
date
Sun, 05 Dec 2021 01:44:39 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
via
1.1 google
merge
ce.lijit.com/ Frame 7E12
Redirect Chain
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=83&3pid=KWSL0RE8-3-ILJG&gdpr=0
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=83&3pid=KWSL0RE8-3-ILJG&gdpr=0
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.49 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap1dca1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://ce.lijit.com/merge?pid=83&3pid=KWSL0RE8-3-ILJG&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
7c5d24517ee193cc868994bc18883d1d
Expires
0
merge
ce.lijit.com/ Frame 7E12
Redirect Chain
  • https://jadserve.postrelease.com/suid/101957?ntv_r=https://ce.lijit.com/merge?pid=90&3pid=NTV_USER_ID&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=90&3pid=c0b28e8e-dbbe-4d07-b7cb-3b1d688f17fb&gdpr=0&gdpr_consent=
43 B
862 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=90&3pid=c0b28e8e-dbbe-4d07-b7cb-3b1d688f17fb&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.49 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap1dca1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
server
nginx/1.12.1
location
https://ce.lijit.com/merge?pid=90&3pid=c0b28e8e-dbbe-4d07-b7cb-3b1d688f17fb&gdpr=0&gdpr_consent=
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
expires
Mon, 1 Jan 1990 12:00:00 GMT
merge
ce.lijit.com/ Frame 7E12
Redirect Chain
  • https://aorta.clickagy.com/pixel.gif?ch=185&cm=37e1e7f6223a458ed25ab69d&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
43 B
860 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.49 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap1dca1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date
Sun, 5 Dec 2021 01:44:39 GMT
server
Aorta/20211029.2f91d75
access-control-allow-origin
access-control-max-age
31536000
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/plain
Location
https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
access-control-expose-headers
Set-Cookie
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
X-Aorta-Region
us-east-1
Connection
keep-alive
X-Aorta-Host
ip-10-42-20-253.ec2.internal
access-control-allow-headers
Origin,cache-control,content-type,man,messagetype,soapaction
Content-Length
0
1f4a5.svg
abs-0.twimg.com/emoji/v2/svg/ Frame 3F7F 		842 B
820 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f4a5.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d700b57f2d2a20509c05ba3130977df9b7ca52f89aa886a5d7e49c7a7a44b91a
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
510
etag
"0Zj5K5kRx/27ErqmlKgZog=="
x-served-by
cache-fty13727-FTY, cache-yul12824-YUL
last-modified
Wed, 21 Feb 2018 22:31:04 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
expires
Thu, 26 Aug 2021 17:28:23 GMT
1f4aa.svg
abs-0.twimg.com/emoji/v2/svg/ Frame 3F7F 		1 KB
880 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f4aa.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9abe6b1f8f8e8903d93e62630394568dbbd09e4fdad84026e2374f3935d5d25f
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
690
etag
"GDfFcZqXc2JkL/r0mQtrrA=="
x-served-by
cache-fty21334-FTY, cache-yul12824-YUL
last-modified
Wed, 15 Apr 2020 20:58:46 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Wed, 08 Jun 2022 09:51:00 GMT
1f6e1.svg
abs-0.twimg.com/emoji/v2/svg/ Frame 3F7F 		433 B
404 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f6e1.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
01c03b8eb0f7f27dd5ec8e28f4fe83079c56521e05b05e5099675154c7f10458
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
293
etag
"rS5NbnuQymAFpQOOIrCZzA=="
x-served-by
cache-fty13727-FTY, cache-yul12824-YUL
last-modified
Wed, 21 Feb 2018 22:31:13 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Wed, 08 Jun 2022 10:47:41 GMT
1f449.svg
abs-0.twimg.com/emoji/v2/svg/ Frame 3F7F 		563 B
512 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f449.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
41578770d740012d57be1d400db47fdba90631e27363a4877af6cc54a032ad10
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
372
etag
"Ay2Qf/SaY+B1fK3V82qyFg=="
x-served-by
cache-fty21325-FTY, cache-yul12824-YUL
last-modified
Wed, 21 Feb 2018 22:30:55 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Wed, 08 Jun 2022 10:38:51 GMT
jot
syndication.twitter.com/i/ Frame 3F7F 		43 B
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638668679448%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-1%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460308766767915013%22%5D%2C%22item_details%22%3A%7B%221460308766767915013%22%3A%7B%22item_type%22%3A0%7D%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.8 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
10
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:44:39 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
528f450bba4fb31a3de58ff7ff236742065a5b066f29e33d0cd1d5725236bd97
x-transaction
b3dd0d45944ded0b
expires
Tue, 31 Mar 1981 05:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 9F5C
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us
  • https://s.amazon-adsystem.com/ecm3?id=KWSL0RE8-3-ILJG&ex=d-rubiconproject.com&status=ok
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=KWSL0RE8-3-ILJG&ex=d-rubiconproject.com&status=ok
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol
HTTP/1.1
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:39 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
HBCABCT8GDCA0E311HWD
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://s.amazon-adsystem.com/ecm3?id=KWSL0RE8-3-ILJG&ex=d-rubiconproject.com&status=ok
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
4f2e9ddc15e6cc2c3861f8e2683d2514
Expires
0
ad-engine-response.gif
trk.vidible.tv/trk/ Frame 4872 		0
0
bc2
bc-ssb-cle.springserve.com/ Frame 5F91 		6 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://bc-ssb-cle.springserve.com/bc2?r=454a31dc-40d3-4e2d-b606-6a2a6143b6b3-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=834
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.161.24 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-189-161-24.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f8c1826c85c5f3b574ff50bacbbf2f6260476649a6321a9fc69c9ae8b82f4031

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
access-control-allow-credentials
true
server
nginx
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
5itnu6hP_normal.jpg
pbs.twimg.com/profile_images/1062794957721821184/ Frame CF46 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/1062794957721821184/5itnu6hP_normal.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
755af9e996edb7ac0fb05eeb681a187e51f8b5e9f11fcb3249228c7cfcff99fd
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Wed, 14 Nov 2018 19:48:38 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, MISS
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
1959
x-served-by
cache-fty13725-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
pixel
googleads.g.doubleclick.net/xbbe/ Frame 8ABE 		624 B
297 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNXcqIVGtIscCevGz1LP0Xy04FOpS3fvgdcStKI9fTwAMzNB5m3BsRRc_RcwqCAb4x-l6KE81D9e3eOu5cWQDxhR2ZwnjQ
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Sun, 05 Dec 2021 01:44:39 GMT
server
cafe
cache-control
private
content-length
276
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame 5C28 		57 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Br6BhyCvGWiyc37L0IdDya9kg36GKbhsDYLZVhJAumP24PsFib1i_uXbzRaOtwAH06gzKLYFZMLrVorOLX-nyosHgXafcR_lh8ANSRbRGdgR3ocuGhKQpk0DXt6nXLlzYeooKNnNJcovHg79Uk2x-xTGLsqQ&dbm_d=AKAmf-D3bOlLWl_GQFJ9MD7soIDXVpvseKVhKS3w4xmOXliC79yh73laAcTuZgLkv076gmr1CL9Qq_VITFl1JgY5Ue3DKVtO3K4I7Y_nHrc_r-fTJvbW4gqpq-3R80jF-JBEd-mddFEyt1pqtB5D2yvgLfLAGZxHHMTaRRAZWOYuSroQ5bccdJfc698lW8jC2daj5Wdbb-19VZWSl_P4B25QhO1FLn_J7XzIYQmnv_OHut7Dr36j1uQ8p0fQDbXcKOwr5hZ92cK-uVK9DtxoTf83B_y5sr0_Kw8UnpdOmL-dLNrNTvp6c3xDQbjIZy9qieOzhnHd4HXXLZX1khRTBgT-AQlWcZH0oVhk2Y9jNCSXaxsXqk241-bfLZD67f_QZ3LniBkVuN7xOBnL76qP_adp48FVMcDMKmTc85JKiMk-CVe7YQudV-pWEyEdaisbZE0hGVrIQp2Q5NUw9eOmv3WvcuYo-o7Ex5YrBCBPMHjedFBq7i_RjOPg0g6B9Df9Jo7L9lkKntcETWBqafuiAjrfalazdZOeKjD2ni_14o4vnBwjKWEbIZr0v-7Do6n48TAQjKT5eGT03Z5fQUH-qnwct9EAzDFilBAzbffJuY_t7Odp_pvmegO1JemCHc_UXseAKRlAWQ8rObz7kOQbY61-J1pJVtV96Ucx-eOZBYbrGNff9kPm1k1jJXFnWpPQI0U0X8ZLL7XEEDUs0bhcx3AbH3AWYSQb6TGgEa9ULV7oDev9s1DrCetAFArjCdU6e7PeVFrAPWTkNTwOh3Nnk22KbltZQeLbtdAV7fe1VjDmQn20Q569APP4ivcc_HnB13v7lNzm3N6sRPMop7ePNAh8HrGcg2jyrZ6JZ_LNczrokogyWmR5vPcVzWDZkFrkocBYlry6d_Pjtf6ORzK0M6BrqfeMr6GW3sDgaQA5hNf5CX6OHMn1HHTmie6XGuVNzsPOyq4eGWI870RpwLgFAgqnDFzYkMm5k7DIrnVO4rAC4euTlZY_z4hxFsfpRv3lFJEc9KS7loHX6lSG1JXOWMrv24Tn9_KMGDJiArhAr01QzuGANOJ24FmKe58BgwFZhIh0rMIh_iPFLQTCbKHCpvf_sgilDG2h5fO7NJtyxcBt8XPb_aKF2IDZnOXZCYPYGEhAFqyKRJnwZODK2_k4WZZqqbcS7mchTKHj-su-iJnrOtRgUjEt-x_uQEs2fNLfeo-Z3pPHAu-AnuQXzsCj_ih6hUVpUo9wJF2o_Ya7U3XGNPmvHuyvRAzsBYCfkQkelY9DOz0gq_6qRwI4pu00UqT1x9sC5DIiE2WJ6TFiM9F5IVftPZzFW5FHf6IGkGjVrLCKNdiQzvmCT1ws5ZMPwfZ3V8C99mNtE6AkBTzre9v9At14eYuaHQow-fsu2A1ZH5s3BED4qVuSuuPC83HVa9rYo1LCCLIlOiTiBh0qT6GdK5Lo4oLc0d28iHM7L8EhKQ0JPkKonTIBjJAnyrSbzSLifGVc2AuqgQdGlvquthdNy2g_z8bh0XxDhQRJ2Av-U3xZaz9gRfytfEi0ty2hIdnH3XToE2XMDSkBmU7kYN-qJg_Jovjwx_4PIa9UUoHBotWH0w4uJgAaHfYI0F7OPYiI-9IGeEwX59oSbTeuZ36swAZZ8H6As1CSwP5UpoXiRojBeKkm40NRnZRNe_On0afLDCxRbjqoDXtwXqOsaSbE4u-CJ_bkQXB1mA05EAFxPsLAa6c-dwkeWm9_-RBqnmmROC6fE3u8uiobkOMFCQfkhtAtGz8LYMvSCmLF31OA9tLkVGP56IMnz_ejkB2X-MfxQ5ecIN6F4a5CK36okfeM-ZaK9W4JEXUYnuiuzPA-EmUSv9pzvizLSJo4J8vIZ-n2IIHkeCzQZ1UmxwDXgSC1VvIfmwvERWcOnuXHOpNC6icuvWKO_G4ZEgbimrMUDoJIB88K1CeDKpt57qJGEBAye5dTDDYeh3qDAQH6gYKZHIVr1iCoF4WQs2VrmG7i6VQdNMlTqzXpai9n3YuMwGxGfc0Zb-No8gzNrQySbKu6_bfgGDLqYO7vHBYWNTQvGeL-xs9LcqOwpQ3bl0Z-jWfUSbcxNvZVgKsubKhZltLKT8-U-Tb8E0oWqWqdK7kU24Q67FE5GiatMivf_tAZcZY-EiHTJ6AzmoUF7fzJT95gduh95KwJDVistMBy5ZeXqrE3Iuy1vBWaV-opcBjjmByrVSEU-SNeSoPPJeU9BQxI7mPmJi9Oi6G2UVNow2DBXVJW00RLWG-rmANON4x8aT4iONQQ4yum-Z1Y4BDsi4QsPtEKUO1pY3-YR2p5emZ-6AOUvGJpgVTd9tFvty2eetYUSN-8uhTV3KQ0jOaKJbW9t4t82H6_Q-lQ3BX5rL1Avsx3OvJ87fgo_5cwZneP7I3d8VKn56wZIfnowQR95GV2rdgzhjfZBqKAsufQ8Qv2Jtfu4LqOtW5WKEMvMNwU9vefcuSUDNqWHZla1REleT3OFcbKZRscikCcN52BLPcdQ6TU0XHOP5UZyoToHtkjlvbzccJKIr_dy4D3liYt7KDsKRc5hPxImEcgKY6m7hVu6A-_Wp7wxs7LXus_ugvpVGkCJ0jyhEIE9E_5Z0TWJbB2BPnvjZgkiTZXgNr62C3UZ-3h0Dd-2p2UllI6bCmfqJ6Gvun9mNv0SDSV6yV057Mbg1PSppX84bKRHylzw16qh60IVSza2DYV_Rq09_9Uszudu7bWeHWcbRSdgb6_zhnUWJMKhML7kKt71ACGIFSUDbTM1Vck2F-GAO57sRcA-5Rw_EcMSN7lTgSxiDXgRyx7aFopOrXmkZ96MAtsOm60rdFkclwIy7quCC6mo_hP17rNQDWMRBGnLtA5sxZ1zbXkNNJ1YCD1kZotlrCOt24rb29FsS3RnMIND5OTqEDwNO5t5k5wVmE8d61Z5L8D7uEEv0CamtQiNtKtaKF3eqgkwGJSlaS30ZUcTsnSQjTG-GqwvTtcca-pKGvz1ZtuHV5eamFPLb1JLjL8sZatydEUbDJVtq-eWyRy8w9gQGgprc_mAo-F9bsGtWU7GyNEf8gfHqhvsdz9FOMZzvWmF6FbdnkPVQo3zlKu_xqSSGQCyxtsZffuJbrRvn8QefiBXkun0tFr8xGXxj7nyXwP2Fdb_pckJCBNbKLurg&cid=CAASEuRodiUmuomIdaeWxgDcxuY7PQ&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d2410ea736ee79fb8b19cecec698d4da996c94b2355eee4cc61f0f9b6bda92c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28536
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
demand-source
d.pub.network/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
content-length
0
via
1.1 google
alt-svc
clear
demand-source
d.pub.network/ 		61 B
234 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
42050a0fdef878dc249fc51498e5c67146a2f9becbef81c1e5edbe32d85435ca

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame 4248 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102636
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
60J1xpBe6gsCEW5b9Tug2eHt3PBAo8RC-qCn74oDqfTmdeQDr_E2DA==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame 4248 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1444718
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
Jeq0LcTODiA63-te6VP8hf0rtaISXyleHlzwGxG-7NvK3WjrY_1V9A==
prebid-universal-creative.js
a.pub.network/core/ Frame 4248 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-universal-creative.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Mv5J2Q==, md5=qhZ9KavhQaYEZZQvkPC+nQ==
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17563
x-guploader-uploadid
ADPycdsekqr_XRLaJHWG_rCg_D2pScsUPeqoeAM_N2cnjtR_Bc1P6OK0aSlVtjMxLNFFviiiA6nxI7e_5Gzxgamy595TKPuepQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Tue, 28 Sep 2021 15:52:36 GMT
server
cloudflare
etag
W/"aa167d29abe141a60465942f90f0be9d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hBQuXZQbJk7WWaqPq8P1n8DRbb5u3bo4eZcNNmaadLMnQQDCv3oJCPlqF4LtdfJX%2Fzpha6sKYYcsZb9pDPjHmMfxlzJ8quza7RilWvqjkeyy7gIqob8AXamhLMuCUt3ewqxToMZmZMr6wqo%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1632844356805025
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
26661
cf-ray
6b8997310a81713e-YUL
expires
Sat, 04 Dec 2021 21:51:56 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 4248 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:39 GMT
demand-source
d.pub.network/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
content-length
0
via
1.1 google
alt-svc
clear
demand-source
d.pub.network/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
content-length
0
via
1.1 google
alt-svc
clear
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame ADE7 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102636
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
8vcIoJy1Z-Czj-ZwL6AtTSA4dcXq2Pa24D0raD5hdTErn8IjPTaY6A==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame ADE7 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-118.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1444718
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1391cb3b815aa63859ec0cff5767737c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
tjUTfdvq50U6wRxuPcT-lZy6zVzWFySmKFTWNxBw8YMrnd4PLJ_yYQ==
prebid-universal-creative.js
a.pub.network/core/ Frame ADE7 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-universal-creative.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Mv5J2Q==, md5=qhZ9KavhQaYEZZQvkPC+nQ==
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17563
x-guploader-uploadid
ADPycdsekqr_XRLaJHWG_rCg_D2pScsUPeqoeAM_N2cnjtR_Bc1P6OK0aSlVtjMxLNFFviiiA6nxI7e_5Gzxgamy595TKPuepQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Tue, 28 Sep 2021 15:52:36 GMT
server
cloudflare
etag
W/"aa167d29abe141a60465942f90f0be9d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iarXd7TbGD5jkVIp50vs5Z6ljF9dkmfb%2Bl%2FGaHtIGfFwUW8QjBnH0%2FRXz6KiYCBAMPCCBUdOhdTz1nsiXLZRvpjbUiJddrtpD2KMY5RYoD6%2BmeUhS27u1OZtduGm4arLYbF9Y0juPOaM7dY%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1632844356805025
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
26661
cf-ray
6b8997313abc713e-YUL
expires
Sat, 04 Dec 2021 21:51:56 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame ADE7 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:44:39 GMT
demand-source
d.pub.network/ 		61 B
234 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
42050a0fdef878dc249fc51498e5c67146a2f9becbef81c1e5edbe32d85435ca

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
demand-source
d.pub.network/ 		61 B
234 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
42050a0fdef878dc249fc51498e5c67146a2f9becbef81c1e5edbe32d85435ca

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:39 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
controltag.js.a1705c5ac5f06cf0c202ff70908fc042
cdn.krxd.net/ctjs/ Frame 69F7 		259 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/womptv2nm.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date
Sun, 05 Dec 2021 01:44:39 GMT
content-encoding
gzip
age
10761989
x-amz-server-side-encryption
AES256
x-cache
HIT
x-cache-hits
5667515
content-length
84509
x-served-by
cache-yul12826-YUL
last-modified
Mon, 02 Aug 2021 12:06:17 GMT
x-timer
S1638668680.881680,VS0,VE0
etag
"a1705c5ac5f06cf0c202ff70908fc042"
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=315360000
accept-ranges
bytes
expires
Thu, 31 Jul 2031 12:06:16 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1638668679895&de=546608977925&d=206%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:39 GMT
FEQI3YLXoAgiP_k
pbs.twimg.com/media/ Frame CF46 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQI3YLXoAgiP_k?format=jpg&name=240x240
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cc8ae86d2fa81aa6c449e05f20d1dd555932a98ea9f973a7f244533c733972bc
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Mon, 15 Nov 2021 17:39:25 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, MISS
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
6574
x-served-by
cache-fty21351-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
FEQI3YLXoAgiP_k
pbs.twimg.com/media/ Frame CF46 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQI3YLXoAgiP_k?format=jpg&name=small
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a21060b05b4e4a70e3f9d26413bd3ee7222944ecb0ea68c3b137c209ff4986b5
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Mon, 15 Nov 2021 17:39:25 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, MISS
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
37091
x-served-by
cache-fty21361-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
MZcvnhsY_normal.jpg
pbs.twimg.com/profile_images/901783088908394496/ Frame 3F7F 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/901783088908394496/MZcvnhsY_normal.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bc740c3112caddaec0203f975f014756ba0aad2b52b76029e0752193bfa2829d
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Sun, 27 Aug 2017 12:24:57 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, HIT
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
1655
x-served-by
cache-fty21371-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
FEQI3YLXoAgiP_k
pbs.twimg.com/media/ Frame 3F7F 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQI3YLXoAgiP_k?format=jpg&name=small
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a21060b05b4e4a70e3f9d26413bd3ee7222944ecb0ea68c3b137c209ff4986b5
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Mon, 15 Nov 2021 17:39:25 GMT
date
Sun, 05 Dec 2021 01:44:39 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, HIT
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
37091
x-served-by
cache-fty21361-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
FEQOmmqXoAUOa_b
pbs.twimg.com/media/ Frame 3F7F 		67 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQOmmqXoAUOa_b?format=jpg&name=small
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2383416635c3508794c060f27958892f5d093d8c58c9484f968fd4e1d0c27857
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Mon, 15 Nov 2021 18:04:29 GMT
date
Sun, 05 Dec 2021 01:44:40 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, MISS
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
69062
x-served-by
cache-fty21348-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
s
googleads.g.doubleclick.net/pagead/drt/ Frame FFFA 		143 B
163 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Sun, 05 Dec 2021 01:34:41 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
599
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
FEQI3YLXoAgiP_k
pbs.twimg.com/media/ Frame CF46 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQI3YLXoAgiP_k?format=jpg&name=small
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a21060b05b4e4a70e3f9d26413bd3ee7222944ecb0ea68c3b137c209ff4986b5
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Mon, 15 Nov 2021 17:39:25 GMT
date
Sun, 05 Dec 2021 01:44:40 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, HIT
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
37091
x-served-by
cache-fty21361-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
627448
vid.springserve.com/vast/ Frame 5F91 		22 B
219 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/627448?w=640&h=480&cb=7852805041225&url=bleepingcomputer.com&ip=37.120.205.182&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36&dnt=&gdpr_consent=&gdpr=&us_privacy=&schain=&ip=37.120.205.182&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36&lat=45.4994&lon=-73.5703&dnt=&desc=&ic=&dur=&ap=&app_bundle=&app_name=&app_store_url=&inv_partner_domain=&vid=&min_dur=&max_dur=&mute=&placement=&skip=&prodq=&content_id=&content_episode=&content_title=&content_series=&content_season=&content_genre=&content_livestream=&content_producer_name=&rating=&channel_name=&language=&network_name=&did=&pp=%7B%7BPRICE_PAID%7D%7D&device_make=Google&device_model=Chrome&brand_name=Google&country=CA&ifa_type=&gdpr_consent=&gdpr=&us_privacy=&payid=a24eb6%3A1224&schain=&coppa=&lmt=&omidpn=%7B%7BOMID_PN%7D%7D&omidpv=%7B%7BOMID_PV%7D%7D&_bchc=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
263b5c14ea0c8dba145eaa30a0e60b7f9e0d3cb3c8f2356f59832ff329fa6d38

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:40 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-length
22
content-type
application/xml;charset=UTF-8
i
vid-io-cle.springserve.com/vd/ Frame 5F91 		0
123 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid-io-cle.springserve.com/vd/i?suuid=454a31dc&ps_id=514171&batch=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.19.190.206 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-19-190-206.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:40 GMT
access-control-allow-credentials
true
server
nginx
content-length
0
5itnu6hP_mini.jpg
pbs.twimg.com/profile_images/1062794957721821184/ Frame 3F7F 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/1062794957721821184/5itnu6hP_mini.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.248.159 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1bf67ddd4ac63675d2dd65b5a3e619a158ce5defdca73301641a8db052b8e4f4
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Wed, 14 Nov 2018 19:48:38 GMT
date
Sun, 05 Dec 2021 01:44:40 GMT
x-tw-cdn
FT
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, HIT
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
1451
x-served-by
cache-fty21344-FTY, cache-bwi5075-BWI, cache-tw-ZZZ1
rum
dsum-sec.casalemedia.com/ Frame 8ABE
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNXcqIVGtIscCevGz1LP0Xy04FOpS3fvgdcStKI9fTwAMzNB5m3BsRRc_RcwqCAb4x-l6KE81D9e3eOu5cWQDxhR2ZwnjQ
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:40 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 8ABE
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YawZhBbaf-sLobsSgmffIQAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNXcqIVGtIscCevGz1LP0Xy04FOpS3fvgdcStKI9fTwAMzNB5m3BsRRc_RcwqCAb4x-l6KE81D9e3eOu5cWQDxhR2ZwnjQ
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:41 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:41 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHi02zuspfbSpmDs0x1dCh4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame 8ABE
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEBPX8qf5w4DoOXbBdrRs5Ig&google_cver=1
43 B
1006 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEBPX8qf5w4DoOXbBdrRs5Ig&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNXcqIVGtIscCevGz1LP0Xy04FOpS3fvgdcStKI9fTwAMzNB5m3BsRRc_RcwqCAb4x-l6KE81D9e3eOu5cWQDxhR2ZwnjQ
Protocol
HTTP/1.1
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:41 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
f85a5ec3-ce1d-4278-905e-703e69b51d8b
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEBPX8qf5w4DoOXbBdrRs5Ig&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 8ABE
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk4NzMwNDE5Mjc3NTQ5NTI5Nw%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk4NzMwNDE5Mjc3NTQ5NTI5Nw%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNXcqIVGtIscCevGz1LP0Xy04FOpS3fvgdcStKI9fTwAMzNB5m3BsRRc_RcwqCAb4x-l6KE81D9e3eOu5cWQDxhR2ZwnjQ
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
cf4c861d-73c9-47da-a891-751c813a2975
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk4NzMwNDE5Mjc3NTQ5NTI5Nw%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame F0A3 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssQnRJw4CvnzHk03fN28V75MliLk3WclGp4tJvgvMB5KA91f4scVTJzHmtN5wPcrht4T3oN4G9tQLU0P-esyMp2h-9F66W3beU3zEapZAxBWXc6eJzeIdlac6AzRDH2xd3xRjTfR3ZdFOKFoMzN_dQa5BjR5SJC_20ML_XSv44fku1Z--k7H7M0-LDXzdgD8jNJzYGzdhLi67ky9uHgxnVipRmAVXsOREdRtOFvIFRruSFKqiQSimEzugTxhlqLFQI4O5KKZ9nDzb9qEdeG35wivKyNOYq6ls7bE3d74Ju3e7tIAWniYlWhDJFXmAtE1M5XnRJIC08dqUjTLA7ZkGmLSIv6z1MFPCePYcp4M7X5olHyFil9APo&sig=Cg0ArKJSzOJvnXSq7VvCEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
dcmads.js
fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497149/dcm/ Frame F0A3 		229 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497149/dcm/dcmads.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.60.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-60-129.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2db2d5706df1eb1a898a5de4b166bffc91c0d63f7bb1dba37c663b6fd112a6e4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
content-encoding
gzip
x-server-name
app39.va.303net.net
content-type
application/javascript;charset=utf-8
access-control-allow-origin
fw.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
expires
Wed, 31 Dec 1969 23:59:59 GMT
appnexus
ny1-bid.adsrvr.org/bid/feedback/ Frame F0A3 		807 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ny1-bid.adsrvr.org/bid/feedback/appnexus?t=1&iid=429d09db-0535-48fb-aeef-449b1f06712e&crid=lw2q2t7y&wp=2.334858&aid=7167056462308187892&wpc=USD&sfe=13e39985&puid=8987304192775495297&tdid=&pid=3i8jb8j&ag=vpjkvsm&adv=m4cpndh&sig=1wtoXP9nzhZsgN4pmv-IqsYqY8EkNADZZBZCYHXZJsvM.&bp=2.33485747640821&cf=2716329&fq=0&td_s=www.bleepingcomputer.com&rcats=2dx,obk,jba,yvb,3gs&mcat=&mste=&mfld=4&mssi=&mfsi=&uhow=164&agsa=&rgz=H3B&svbttd=1&dt=PC&osf=Windows&os=Windows10&br=Chrome&rlangs=en&mlang=&svpid=7125&did=1267594&rcxt=Other&lat=45.499400&lon=-73.570300&tmpc=-7.25&daid=&vp=0&osi=&osv=&mk=Google&mdl=Chrome%20-%20Windows&c=CgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..&dur=CkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.&durs=y6VEMw&crrelr=&adpt=anor&ipl=bleepingcomputer_728x90_970x90_970x250_320x50_ATF/bleepingcomputer_728x90_970x90_970x250_320x50_ATF&pcm=1&vc=3&said=7480474431045220042&ict=Unknown&auct=1&im=1&mc=ad038fb7-631f-47ff-86ff-2afd5470d9af
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software
Kestrel /
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
cache-control
must-revalidate, no-cache
server
Kestrel
content-type
image/gif
transfer-encoding
chunked
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
ca
choices.truste.com/ Frame F0A3 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=tradedesk01&aid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&c=tradedesk01cont1&js=pmw0&w=728&h=90&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-32.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
6b3dadacf3fa028c53f78d0b543b15203609955b2bab711a6f659ef8eec1fa3d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 21:42:42 GMT
content-encoding
gzip
server
nginx
age
14518
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 1e50ca9ac269e92d749f11227b12760d.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C3
x-amz-cf-id
uLnx5kYC9irEvPMiuGxyALGRJDNik3V0H3RAZCaFwkvWza7vfXoBsQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
moatad.js
z.moatads.com/thetradedeskv275874568748/ Frame F0A3 		328 KB
111 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/thetradedeskv275874568748/moatad.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
762072bf05605eac7dbd75afd26a52645f467038fa9b8d75620fa942eff0685e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
content-encoding
gzip
last-modified
Tue, 02 Nov 2021 14:49:34 GMT
server
AmazonS3
x-amz-request-id
P9CGY8GFQNVSQYBX
etag
"cc32731696ee8344d5a0d79d0db0801d"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11123
accept-ranges
bytes
content-length
112750
x-amz-id-2
P5mvW7NJdo0AhfyKQDlBNs+dzrgEHg+b4jPGgv91mMfm/yegiaLrMc+3vRhn6LeqU/UqI4wAEWk=
trk.js
cdn.adnxs.com/v/s/221/ Frame F0A3 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/221/trk.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5beecaeceee4fae5080c40d2ad96dd7c0b7e5a9bc242fbe2b99ab1276aaaae94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:40 GMT
Content-Encoding
gzip
Age
2821537
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
29240
X-Served-By
cache-lga21963-LGA, cache-yul12820-YUL
Access-Control-Allow-Origin
*, *
Last-Modified
Tue, 02 Nov 2021 09:57:21 GMT
Server
AkamaiNetStorage
X-Timer
S1638668681.503370,VS0,VE0
ETag
"f0105ab6d7d1878d827eb99659d44d8f:1635847041.806544"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Via
1.1 varnish, 1.1 varnish
Expires
Wed, 02 Nov 2022 09:59:04 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
2, 787117
it
nym1-ib.adnxs.com/ Frame F0A3 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F&e=wqT_3QKXBvBMFwMAAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9KgBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC-AAwCIAwGQAwCYAxegAwGqAyoaEzcxNjcwNTY0NjIzMDgxODc4OTIqBDIwNjU6DW9ydGItbHcycTJ0N3nAA6wCyAMA2AP77xjgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMzcuMTIwLjIwNS4xODKoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAElvqQmgGIBQGYBQCgBcrt3u7J-_7nZ8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBagD-gUECAAQAJAGAJgGAKIGDjcxMjUjTllNMjo1Mjc5uAYAwQYAAAAAAADwP9AGxNAB2gYWChAh_S4BAPBSEAAYAOAGAfIGcgiKr00SbEFoRUw5azBBQUFBREFBa0NCUUVJeEpqbkJ4RG9pclVDR0pDYWtBTWdCeWdBUU02Sm9RZEk1SkNoQjFDSExWaWZLWEUBPAkBFEhnQWdRRQkMAQHwPElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoHB2F3Mndscze6Bw8IABAAGAAgADAAOLIEQADIB7_NBdIHDQkJtgRJQAEeCNoHBgknROAHAOoHAggA8Afa_xiKCAIQAA..&s=a4273c59291343a224a78bc3e47451c3186f144a
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
7d651806-5dab-4b33-89c9-dc37e9cb7f3a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5491 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvKYkCBc1hLSbP4RM2wFqTHD25wS-mT8ICewlhV8Yk8F79UpIQ7ey8lE4rtdU2R25EA815ufKT5nkoWG5ieFU3SGuv6tAh4zDR-4GcPU4D5pwCVVVQXTLfKwUIQJRvylj9yDEHWCkqfAv3yYH_1pDBKhzORWO6zMUgCgYqRtWtdp9K9O138yr2Z_IK6CM2qRI-SB68llWEf6ukHKNmgfRwfuthBJ4fzEoXYPcYVY7WsUU3TO1ImwK0LcILIGqHV292geslX5VTy2r9FSzrZDm7OKADm6rXG-88Bpytm2INkKEV76ahVS6cu4MpWEOrJHqeFq9s1kVC9hU3RePpLJCvDWP2DUjTayeVT_x_hcM8wQA&sig=Cg0ArKJSzJnpN863NniOEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
dcmads.js
fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497149/dcm/ Frame 5491 		229 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497149/dcm/dcmads.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.60.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-60-129.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e579dc45dc35bc07014667ded505084755528742d89482c286142b1511a2f2fa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
content-encoding
gzip
x-server-name
app24.va.303net.net
content-type
application/javascript;charset=utf-8
access-control-allow-origin
fw.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
expires
Wed, 31 Dec 1969 23:59:59 GMT
appnexus
ny1-bid.adsrvr.org/bid/feedback/ Frame 5491 		807 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ny1-bid.adsrvr.org/bid/feedback/appnexus?t=1&iid=944e8539-133d-4ade-8716-db20c61496c3&crid=lw2q2t7y&wp=2.334858&aid=6677083780141277333&wpc=USD&sfe=13e39985&puid=8987304192775495297&tdid=&pid=3i8jb8j&ag=vpjkvsm&adv=m4cpndh&sig=1ve1WQra57UAJVzXMv1-3_w4PeGWAsCi_BAjzCVdd3NM.&bp=2.33485747640821&cf=2716329&fq=0&td_s=www.bleepingcomputer.com&rcats=2dx,obk,jba,yvb,3gs&mcat=&mste=&mfld=4&mssi=&mfsi=&uhow=164&agsa=&rgz=H3B&svbttd=1&dt=PC&osf=Windows&os=Windows10&br=Chrome&rlangs=en&mlang=&svpid=7125&did=1267594&rcxt=Other&lat=45.499400&lon=-73.570300&tmpc=-7.25&daid=&vp=0&osi=&osv=&mk=Google&mdl=Chrome%20-%20Windows&c=CgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..&dur=CkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.&durs=y6VEMw&crrelr=&adpt=anor&ipl=bleepingcomputer_728x90_320x50_InContent_1/bleepingcomputer_728x90_320x50_InContent_1&pcm=1&vc=3&said=7480474431045220042&ict=Unknown&auct=1&im=1&mc=ad038fb7-631f-47ff-86ff-2afd5470d9af
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software
Kestrel /
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:39 GMT
cache-control
must-revalidate, no-cache
server
Kestrel
content-type
image/gif
transfer-encoding
chunked
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
ca
choices.truste.com/ Frame 5491 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=tradedesk01&aid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&c=tradedesk01cont1&js=pmw0&w=728&h=90&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-32.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
6b3dadacf3fa028c53f78d0b543b15203609955b2bab711a6f659ef8eec1fa3d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 21:42:42 GMT
content-encoding
gzip
server
nginx
age
14518
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 1e50ca9ac269e92d749f11227b12760d.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C3
x-amz-cf-id
DtJphxeptk53QfiaEgSBL2n8lS2FACK4Z4hd0UVVLs5-iA8fHbsNMQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
moatad.js
z.moatads.com/thetradedeskv275874568748/ Frame 5491 		328 KB
111 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/thetradedeskv275874568748/moatad.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
762072bf05605eac7dbd75afd26a52645f467038fa9b8d75620fa942eff0685e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
content-encoding
gzip
last-modified
Tue, 02 Nov 2021 14:49:34 GMT
server
AmazonS3
x-amz-request-id
P9CGY8GFQNVSQYBX
etag
"cc32731696ee8344d5a0d79d0db0801d"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11123
accept-ranges
bytes
content-length
112750
x-amz-id-2
P5mvW7NJdo0AhfyKQDlBNs+dzrgEHg+b4jPGgv91mMfm/yegiaLrMc+3vRhn6LeqU/UqI4wAEWk=
trk.js
cdn.adnxs.com/v/s/221/ Frame 5491 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/221/trk.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5beecaeceee4fae5080c40d2ad96dd7c0b7e5a9bc242fbe2b99ab1276aaaae94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:40 GMT
Content-Encoding
gzip
Age
2821537
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
29240
X-Served-By
cache-lga21963-LGA, cache-yul12820-YUL
Access-Control-Allow-Origin
*, *
Last-Modified
Tue, 02 Nov 2021 09:57:21 GMT
Server
AkamaiNetStorage
X-Timer
S1638668681.640984,VS0,VE0
ETag
"f0105ab6d7d1878d827eb99659d44d8f:1635847041.806544"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Via
1.1 varnish, 1.1 varnish
Expires
Wed, 02 Nov 2022 09:59:04 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
2, 787118
it
nym1-ib.adnxs.com/ Frame 5491 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F&e=wqT_3QKXBvBMFwMAAAMA1gAFAQiFs7CNBhCVwd-WpIrx1FwYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9KgBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAqLPXOoCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC-AAwCIAwGQAwCYAxegAwGqAyoaEzY2NzcwODM3ODAxNDEyNzczMzMqBDIwNjU6DW9ydGItbHcycTJ0N3nAA6wCyAMA2AP77xjgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMzcuMTIwLjIwNS4xODKoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAElvqQmgGIBQGYBQCgBcrt3u7J-_7nZ8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBagD-gUECAAQAJAGAJgGAKIGDjcxMjUjTllNMjo1Mjc5uAYAwQYAAAAAAADwP9AGxNAB2gYWChAh_S4BAPBSEAAYAOAGAfIGcgiKr00SbEFoRUw5azBBQUFBREFBa0NCUUVJeEpqbkJ4RG9pclVDR0pDYWtBTWdCeWdBUU02Sm9RZEk1SkNoQjFDSExWaWZLWEUBPAkBFEhnQWdRRQkMAQHwPElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoHB2F3Mndscze6Bw8IABAAGAAgADAAOLIEQADIB7_NBdIHDQkJtgRJQAEeCNoHBgknROAHAOoHAggA8Afa_xiKCAIQAA..&s=4d911b1796528aa9c931aade65e57078fcb184ab
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
4be4b3f1-5552-45a6-93a7-9bc49d401355
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 08B5 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssuGEnDcDgc6UC4KSnlrOulwH3mr0OluCfk5_wSPDDmcMv2J8X_hyzRU-DJr4jq0_3zHdAnGkkN8yvdeAsaV130PAUJfgWAxhWKdOCFT-YX0kV5ni88fhST3kq0rKb6w8jGZRobscATXbUVPw-__oiBHfJNYEaQ1n1VqTSCEtcC6-SnN_i25_IsDQjUAJwvBT1psXYunoP9xeyceDrM5idKNlGVExbs-WFb2n9bn8by67s9PUToMKkOnnkQKkd_1KvfgVXx-FeCLvARDp5ir4HLOeeIbAIHBA3sqFsTb6edFuuZfrwxt7zhSV6lOPpczKDu81_jiTNPnJrwlU6jqaAHGYV4-fWYW_sle3NApElCVwzn7KvCTw&sig=Cg0ArKJSzHGtrv8-aw1xEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
dcmads.js
fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497151/dcm/ Frame 08B5 		229 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497151/dcm/dcmads.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.60.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-60-129.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4a73235c1476b3cf7f7eecb637ca2842db3084523a177b51c88f238a54d0f8ae

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
content-encoding
gzip
x-server-name
app26.va.303net.net
content-type
application/javascript;charset=utf-8
access-control-allow-origin
fw.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
expires
Wed, 31 Dec 1969 23:59:59 GMT
pushpull
ws.rqtrk.eu/ Frame 08B5
Redirect Chain
  • https://ny1-bid.adsrvr.org/bid/feedback/appnexus?t=1&iid=9090efe1-fb9c-442d-803b-1d7ac113fa60&crid=oybxzi69&wp=2.334858&aid=3232489538087091304&wpc=USD&sfe=13e39985&puid=8987304192775495297&tdid=&p...
  • https://odr.mookie1.com/t/v2?tagid=V2_2087&src.visitorId=7de5ca57-c954-4db1-bc90-ae26323dfac5&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10597814350218064749&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_2086%26src.visi...
  • https://odr.mookie1.com/t/v2?tagid=V2_2086&src.visitorid=a507803e-3812-41e4-80b2-78e5739cd1db&gdpr_consent=&gdpr=0
  • https://ws.rqtrk.eu/pushpull?dmp=8f69b95d-3b90-4a14-a0a2-c85909244e3f&uid=10597814350218064749&gdpr=1&gdpr_consent=&redirect=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_1004440%26src.visito...
43 B
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ws.rqtrk.eu/pushpull?dmp=8f69b95d-3b90-4a14-a0a2-c85909244e3f&uid=10597814350218064749&gdpr=1&gdpr_consent=&redirect=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_1004440%26src.visitorid%3D%24BROWSER_ID%26gdpr_consent%3D%24GDPR_CONSENT%26gdpr%3D%24GDPR
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
147.135.11.205 , United States, ASN16276 (OVH, FR),
Reverse DNS
us004.roqad.pl
Software
openresty /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:42 GMT
Server
openresty
P3P
CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
Cache-Control
no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:41 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
via
1.1 google
server
Apache
p3p
CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location
https://ws.rqtrk.eu/pushpull?dmp=8f69b95d-3b90-4a14-a0a2-c85909244e3f&uid=10597814350218064749&gdpr=1&gdpr_consent=&redirect=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_1004440%26src.visitorid%3D%24BROWSER_ID%26gdpr_consent%3D%24GDPR_CONSENT%26gdpr%3D%24GDPR
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
x-application-context
application
expires
Thu, 01 Jan 1970 00:00:00 GMT
ca
choices.truste.com/ Frame 08B5 		27 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=tradedesk01&aid=tradedesk01&cid=aw2wls7_vpjkvsm_oybxzi69&c=tradedesk01cont1&js=pmw0&w=300&h=250&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-32.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
612fceda8faecf8133dac77ef5f4eb30be265cadd946541f796a74efe25cd3c7

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 15:46:38 GMT
content-encoding
gzip
server
nginx
age
35882
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 1e50ca9ac269e92d749f11227b12760d.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C3
x-amz-cf-id
7yuaDSC3IuRxmwNhbu1sx4Aoa102ui-e4tYDzubQCb-bcJ7OBahT2Q==
expires
Mon, 26 Jul 1997 05:00:00 GMT
moatad.js
z.moatads.com/thetradedeskv275874568748/ Frame 08B5 		328 KB
111 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/thetradedeskv275874568748/moatad.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
762072bf05605eac7dbd75afd26a52645f467038fa9b8d75620fa942eff0685e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
content-encoding
gzip
last-modified
Tue, 02 Nov 2021 14:49:34 GMT
server
AmazonS3
x-amz-request-id
P9CGY8GFQNVSQYBX
etag
"cc32731696ee8344d5a0d79d0db0801d"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11123
accept-ranges
bytes
content-length
112750
x-amz-id-2
P5mvW7NJdo0AhfyKQDlBNs+dzrgEHg+b4jPGgv91mMfm/yegiaLrMc+3vRhn6LeqU/UqI4wAEWk=
trk.js
cdn.adnxs.com/v/s/221/ Frame 08B5 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/221/trk.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5beecaeceee4fae5080c40d2ad96dd7c0b7e5a9bc242fbe2b99ab1276aaaae94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:40 GMT
Content-Encoding
gzip
Age
2821537
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
29240
X-Served-By
cache-lga21963-LGA, cache-yul12820-YUL
Access-Control-Allow-Origin
*, *
Last-Modified
Tue, 02 Nov 2021 09:57:21 GMT
Server
AkamaiNetStorage
X-Timer
S1638668681.797926,VS0,VE0
ETag
"f0105ab6d7d1878d827eb99659d44d8f:1635847041.806544"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Via
1.1 varnish, 1.1 varnish
Expires
Wed, 02 Nov 2022 09:59:04 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
2, 787120
it
nym1-ib.adnxs.com/ Frame 08B5 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F&e=wqT_3QKZBvBMGQMAAAMA1gAFAQiFs7CNBhDo-OOOvIOH7iwYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUI36kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9LYBmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAp5I4AKd_1vqAm1odHRwczovL3d3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbS9uZXdzL3NlY3VyaXR5L2Vtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QvgAMAiAMBkAMAmAMXoAMBqgMqGhMzMjMyNDg5NTM4MDg3MDkxMzA0KgQyMDY1Og1vcnRiLW95Ynh6aTY5wAOsAsgDANgD--8Y4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjM3LjEyMC4yMDUuMTgyqAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANoEAggB4AQB8ASN-pCaAYgFAZgFAKAFyu3e7sn7_udnwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFqAP6BQQIABAAkAYAmAYAogYONzEyNSNOWU0yOjUyNzm4BgDBBgAAAAAAAPA_0AbE0AHaBhYKEAAAAAAAAAAAAAAAAEEL8FIQABgA4AYB8gZyCIqvTRJsQWhFTDlrMEFBQUFEQUFrQ0JRRUl4SmpuQnhEb2lyVUNHSkNha0FNZ0J5Z0FRTTZKb1FkSTVKQ2hCMUNITFZpZktYRQE8CQEUSGdBZ1FFCQwBAfA8SWdCQUpBQkFKb0JBZ2dBgAcBiAcAoAcBqgcHYXcyd2xzN7oHDwgAEAAYACAAMAA4sgRAAMgHv80F0gcNCQGuDAAASUABHgjaBwYJJ0TgBwDqBwIIAPAH2v8YiggCEAA.&s=85e02bc66d50d641096562b61a8fab250b65dfda
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:40 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
23ae6375-d3f9-4b4a-a7d7-2b6d19966bce
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame 9C49 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Ctl3thBmsYbqTDozyMZj5uoAJ1qWtl2bl4LLj7g771fT9CBABIMeD_AFg_eiigfADoAGPs46_A8gBAqgDAaoErQJP0IRuF8GQz-jdmr5aho5eIH536vayoY9Q01cw3gkSLtT2xVkPgugdjAtr3FD37MLMMqwFaGtun2T4j8hLXOKSCJRUq-bbt8oN5Rsk4_KIlvpX-A-qgWfHn_Q4tm1C77qicB02qISTmBr27mbwpIDqKmB7JME-_r-46MM34gtcS7fUPwAjnndxz9-1An8Lg3C0zP-fr2x1PQkgpowxkeurbEj0qE6JVI53UyFjmq9XvmtrY7a0iWZFoLu2j1EI6ZD62cxT9t-tlro7ojP3JjPM1W3OHRihZYNyscp_HnkOxkKTQXoRkyo1pkjN52zpO3baQWLCuHm4qL9p4zH4b-riSoaljdHBB3cjQDWj5Px4dYTzEHsVi1oRuXuVFNeU8RadLT1Hx6x5hZRuV_mKwATJmZjy5gOgBgKAB62kvbQBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ3LAp0ggHCIBhEAEYH4AKAcgLAdgTA9AVAYAXAbIXHAoaCAASFHB1Yi0wOTIwODk5MzAwMzk3ODIzGAA&sigh=5euEGIhh7VY&vt=1&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:44:40 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
activeview
pagead2.googlesyndication.com/pcs/ Frame 9C49 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsscA8TEE3YAL2Fh90QPwtJMBzJjDr675T-WZSQoNBix3QrbonVwPS8z-Bk7O6k5lozMLr0RcvBZG7loRx0WbNVrGDisOzG87op1pK4mzgnXHhRFRco&sai=AMfl-YThpWmzcU230iGLC0TDoyTefLvDdp4Jb-AWKL80SZiE4jzi4zdpWzS9rF3ackXEH75oSy_gA4m6MaAO&sig=Cg0ArKJSzN6nUXCfRjJLEAE&id=lidar2&mcvt=1653&p=0,0,124,1005&mtos=863,1528,1653,1653,1653&tos=863,665,125,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&pay=1&rst=1638668678447&rpt=553&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
i
vid-io-cle.springserve.com/vd/ Frame 5F91 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid-io-cle.springserve.com/vd/i?suuid=454a31dc&ps_id=514171&batch=2
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.19.190.206 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-19-190-206.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:40 GMT
access-control-allow-credentials
true
server
nginx
content-length
0
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 5C28 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2b2d2472f310f3a4c880947f473b8de3e58662291206e24a5426ee2bd64684ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:43:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
44
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9494
x-xss-protection
0
server
cafe
etag
6798282995721486617
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:43:56 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 5C28 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:35:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
535
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:35:45 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 5C28 		0
571 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss4Ven__LFNfE_8n0awcqb-ej4_QgcCX11Df3xdsVxnuaXk1K-Bj7MktAh_-E-URBkO6iuDY3oOxUQoxs6vJXKF9xB2yuJofQHz-zh0m34a-9HZML5YGXToQRyTe2aRu4gBZeSYi9RdBP-2XLozk7ywvjbji0YX8LChHRCvw2uI2Ao7CIvZj7RDHNxlx7bpIrGDZgPudgV-ztuAKBL7CSbIpyYoRAnLr3ERK4ThnDKvvdrxfWfJAXth6Ganz8uCAz2hUwcyw-VEaUdKInjn29_kJGSuI6_K-1-WeFzFlleNpijvE4YhC9pzIjwJ6iKfo_wJcQ9k1EcTrZv0mpI5SnMRflx2s6fCxTmClbqvBbxS-f6Vvo_Fg1gPtoNJSZBfzl9pB1LzdfZuzOauT2WHhfw-q1fO7iTqOqlAGqAExAQdvm8IOunkVlpR21luz4KMVL6gnTluTf6lLxEMEVM69k7FqgEqNqqiXz7YY-FXTJG_Qy8GixhBCB9G9CozLQyY19e-6nWZ865RLIQGI330vEmjnZ1SVQSC1Kb43VMWIzm46c9edUJnC-L89F5TNQeE_gLqPI0u4mARcriaZdXnefDVKaj3sxldzJwip3-RPcptz9zTKE5N2p8O6lAXrk36XE5i7serHhtmeJwG5iksGOJZ5lTLnHsJB1mcP6gUQRlvLK6gogEnAbl9LOYUrjmjH9Q25lYbueic-E2CBpoXlbfTgIPbBu6d--7-ZbitBzN0k6t7CGlBA9yq6lHr2AsF5BlRKP7Q6rLb-qh3R8OqbTiQY7RwPT1UK2Gsv3I7h-t-BBoXCwP65eJphNkEgHA3vOuPar2HPBh8gsk2gttHDmYZQaF6kVJaDLornbiDasTaP45xBaSfOUzJ-wT4v7Si2gc_cQ8F7O6QTD1jMXBJblHJxrRhGDMuMa7sLUS6-Apm_oTUNd2Wux4FgalQ3Hsb1jaGF7bYfILehe0NsX7uBYHurN3UxF-x3O8lT3gerLWuLi-kne4y44psoF-T4uSayStiYf-CeUnaHBvsEUYuS7M2mCvXb0l3yL_cBb_OylHwYV_8w5kCseFFyqlj1rmeY2lE6-P57XFnsqflJ34m7Com6vKodJ907oohH4JAboUZGLwBmxwUXBwjZMDTpg3twK_2eHVEmQcGnaBCN3eHYQlkvxBwi60bTdeEIWQe475qI_dR08cT9z8ss41dzd2-xjZezgbpZJxU78G4wsNlZLMd2rT-nw&sai=AMfl-YS7_fv_cuRFu9AqCQxbUvIzH7XZ-qYgkPwYQiUMT8h6NTqprvxNQ1QKuwdrAyucdk7VqJn4pJbN5m-5j3eNJOcf7gWbwu5PFdoSM51u_w5fOt5RpK0rZ9x9LipaM-9_v9wZx5GXzBnk8DsluHoGkdqdkw7u2Q&sig=Cg0ArKJSzNPph903nSCtEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.89332&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Br6BhyCvGWiyc37L0IdDya9kg36GKbhsDYLZVhJAumP24PsFib1i_uXbzRaOtwAH06gzKLYFZMLrVorOLX-nyosHgXafcR_lh8ANSRbRGdgR3ocuGhKQpk0DXt6nXLlzYeooKNnNJcovHg79Uk2x-xTGLsqQ&dbm_d=AKAmf-D3bOlLWl_GQFJ9MD7soIDXVpvseKVhKS3w4xmOXliC79yh73laAcTuZgLkv076gmr1CL9Qq_VITFl1JgY5Ue3DKVtO3K4I7Y_nHrc_r-fTJvbW4gqpq-3R80jF-JBEd-mddFEyt1pqtB5D2yvgLfLAGZxHHMTaRRAZWOYuSroQ5bccdJfc698lW8jC2daj5Wdbb-19VZWSl_P4B25QhO1FLn_J7XzIYQmnv_OHut7Dr36j1uQ8p0fQDbXcKOwr5hZ92cK-uVK9DtxoTf83B_y5sr0_Kw8UnpdOmL-dLNrNTvp6c3xDQbjIZy9qieOzhnHd4HXXLZX1khRTBgT-AQlWcZH0oVhk2Y9jNCSXaxsXqk241-bfLZD67f_QZ3LniBkVuN7xOBnL76qP_adp48FVMcDMKmTc85JKiMk-CVe7YQudV-pWEyEdaisbZE0hGVrIQp2Q5NUw9eOmv3WvcuYo-o7Ex5YrBCBPMHjedFBq7i_RjOPg0g6B9Df9Jo7L9lkKntcETWBqafuiAjrfalazdZOeKjD2ni_14o4vnBwjKWEbIZr0v-7Do6n48TAQjKT5eGT03Z5fQUH-qnwct9EAzDFilBAzbffJuY_t7Odp_pvmegO1JemCHc_UXseAKRlAWQ8rObz7kOQbY61-J1pJVtV96Ucx-eOZBYbrGNff9kPm1k1jJXFnWpPQI0U0X8ZLL7XEEDUs0bhcx3AbH3AWYSQb6TGgEa9ULV7oDev9s1DrCetAFArjCdU6e7PeVFrAPWTkNTwOh3Nnk22KbltZQeLbtdAV7fe1VjDmQn20Q569APP4ivcc_HnB13v7lNzm3N6sRPMop7ePNAh8HrGcg2jyrZ6JZ_LNczrokogyWmR5vPcVzWDZkFrkocBYlry6d_Pjtf6ORzK0M6BrqfeMr6GW3sDgaQA5hNf5CX6OHMn1HHTmie6XGuVNzsPOyq4eGWI870RpwLgFAgqnDFzYkMm5k7DIrnVO4rAC4euTlZY_z4hxFsfpRv3lFJEc9KS7loHX6lSG1JXOWMrv24Tn9_KMGDJiArhAr01QzuGANOJ24FmKe58BgwFZhIh0rMIh_iPFLQTCbKHCpvf_sgilDG2h5fO7NJtyxcBt8XPb_aKF2IDZnOXZCYPYGEhAFqyKRJnwZODK2_k4WZZqqbcS7mchTKHj-su-iJnrOtRgUjEt-x_uQEs2fNLfeo-Z3pPHAu-AnuQXzsCj_ih6hUVpUo9wJF2o_Ya7U3XGNPmvHuyvRAzsBYCfkQkelY9DOz0gq_6qRwI4pu00UqT1x9sC5DIiE2WJ6TFiM9F5IVftPZzFW5FHf6IGkGjVrLCKNdiQzvmCT1ws5ZMPwfZ3V8C99mNtE6AkBTzre9v9At14eYuaHQow-fsu2A1ZH5s3BED4qVuSuuPC83HVa9rYo1LCCLIlOiTiBh0qT6GdK5Lo4oLc0d28iHM7L8EhKQ0JPkKonTIBjJAnyrSbzSLifGVc2AuqgQdGlvquthdNy2g_z8bh0XxDhQRJ2Av-U3xZaz9gRfytfEi0ty2hIdnH3XToE2XMDSkBmU7kYN-qJg_Jovjwx_4PIa9UUoHBotWH0w4uJgAaHfYI0F7OPYiI-9IGeEwX59oSbTeuZ36swAZZ8H6As1CSwP5UpoXiRojBeKkm40NRnZRNe_On0afLDCxRbjqoDXtwXqOsaSbE4u-CJ_bkQXB1mA05EAFxPsLAa6c-dwkeWm9_-RBqnmmROC6fE3u8uiobkOMFCQfkhtAtGz8LYMvSCmLF31OA9tLkVGP56IMnz_ejkB2X-MfxQ5ecIN6F4a5CK36okfeM-ZaK9W4JEXUYnuiuzPA-EmUSv9pzvizLSJo4J8vIZ-n2IIHkeCzQZ1UmxwDXgSC1VvIfmwvERWcOnuXHOpNC6icuvWKO_G4ZEgbimrMUDoJIB88K1CeDKpt57qJGEBAye5dTDDYeh3qDAQH6gYKZHIVr1iCoF4WQs2VrmG7i6VQdNMlTqzXpai9n3YuMwGxGfc0Zb-No8gzNrQySbKu6_bfgGDLqYO7vHBYWNTQvGeL-xs9LcqOwpQ3bl0Z-jWfUSbcxNvZVgKsubKhZltLKT8-U-Tb8E0oWqWqdK7kU24Q67FE5GiatMivf_tAZcZY-EiHTJ6AzmoUF7fzJT95gduh95KwJDVistMBy5ZeXqrE3Iuy1vBWaV-opcBjjmByrVSEU-SNeSoPPJeU9BQxI7mPmJi9Oi6G2UVNow2DBXVJW00RLWG-rmANON4x8aT4iONQQ4yum-Z1Y4BDsi4QsPtEKUO1pY3-YR2p5emZ-6AOUvGJpgVTd9tFvty2eetYUSN-8uhTV3KQ0jOaKJbW9t4t82H6_Q-lQ3BX5rL1Avsx3OvJ87fgo_5cwZneP7I3d8VKn56wZIfnowQR95GV2rdgzhjfZBqKAsufQ8Qv2Jtfu4LqOtW5WKEMvMNwU9vefcuSUDNqWHZla1REleT3OFcbKZRscikCcN52BLPcdQ6TU0XHOP5UZyoToHtkjlvbzccJKIr_dy4D3liYt7KDsKRc5hPxImEcgKY6m7hVu6A-_Wp7wxs7LXus_ugvpVGkCJ0jyhEIE9E_5Z0TWJbB2BPnvjZgkiTZXgNr62C3UZ-3h0Dd-2p2UllI6bCmfqJ6Gvun9mNv0SDSV6yV057Mbg1PSppX84bKRHylzw16qh60IVSza2DYV_Rq09_9Uszudu7bWeHWcbRSdgb6_zhnUWJMKhML7kKt71ACGIFSUDbTM1Vck2F-GAO57sRcA-5Rw_EcMSN7lTgSxiDXgRyx7aFopOrXmkZ96MAtsOm60rdFkclwIy7quCC6mo_hP17rNQDWMRBGnLtA5sxZ1zbXkNNJ1YCD1kZotlrCOt24rb29FsS3RnMIND5OTqEDwNO5t5k5wVmE8d61Z5L8D7uEEv0CamtQiNtKtaKF3eqgkwGJSlaS30ZUcTsnSQjTG-GqwvTtcca-pKGvz1ZtuHV5eamFPLb1JLjL8sZatydEUbDJVtq-eWyRy8w9gQGgprc_mAo-F9bsGtWU7GyNEf8gfHqhvsdz9FOMZzvWmF6FbdnkPVQo3zlKu_xqSSGQCyxtsZffuJbrRvn8QefiBXkun0tFr8xGXxj7nyXwP2Fdb_pckJCBNbKLurg&cid=CAASEuRodiUmuomIdaeWxgDcxuY7PQ&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Sun, 05 Dec 2021 01:44:40 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
attribution.js
storage.googleapis.com/session-hub/ Frame 5C28 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/session-hub/attribution.js?action=viewPlacement&aid=514676249
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::2010 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
0f43d6dfd24b62e95baf46356acc669f8a0d75f10daea9778d1798410b84dd62

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:13:53 GMT
age
1847
x-guploader-uploadid
ADPycduKuNHo3838SLqLHHKfgklFIRW64PvanEBChqn9m2zfZc65S3fdlc2zlGU7WK2F6XvDwM17ykCSoh7NimmENCJDiabyGg
x-goog-storage-class
REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2827
last-modified
Wed, 28 Aug 2019 19:06:32 GMT
server
UploadServer
etag
"0fa34f86fbf088bfba14359ffb4ba82b"
x-goog-hash
crc32c=1TZ2bg==, md5=D6NPhvvwiL+6FDWf+0uoKw==
content-language
en
x-goog-generation
1567019192385890
cache-control
public, max-age=3600
x-goog-stored-content-length
2827
accept-ranges
bytes
content-type
application/javascript
expires
Sun, 05 Dec 2021 02:13:53 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 5C28 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77569
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
0646-iptv-ban-noel-solo-728x90-2112-en.jpg
s0.2mdn.net/9579671/ Frame 5C28 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/9579671/0646-iptv-ban-noel-solo-728x90-2112-en.jpg
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c399981a6bcd319b139bdce81ba6ff1f34528c7026c147d70edc6e560ef45d6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:14:22 GMT
x-content-type-options
nosniff
age
23418
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23765
x-xss-protection
0
last-modified
Thu, 02 Dec 2021 18:52:21 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 19:14:22 GMT
9427dd0d-835c-471c-a5db-ab01ae8a681c
consumer.krxd.net/consent/get/ Frame 69F7 		234 B
316 B 		Script
General
Check archive.org
Download Go to
Full URL
https://consumer.krxd.net/consent/get/9427dd0d-835c-471c-a5db-ab01ae8a681c?idt=device&dt=kxcookie&callback=Krux.ns.investingchannelinc.kxjsonp_consent_get_0
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b429dacc88a6a03aec0c4056dc1bbcf870fb47b1accc5a6d776aa46ec47dd44f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
via
1.1 varnish
age
0
x-served-by
consumer-a020-ash-prod.krxd.net, cache-yul12824-YUL
vary
Accept-Encoding
x-cache
MISS, MISS
content-type
text/javascript; charset=UTF-8
content-encoding
gzip
cache-control
max-age=1800
x-age
0
accept-ranges
bytes
x-timer
S1638668681.899817,VS0,VE21
content-length
193
x-cache-hits
0, 0
jot
syndication.twitter.com/i/ Frame CF46 		43 B
166 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638668680923%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460302706954981385%22%5D%2C%22item_details%22%3A%7B%221460302706954981385%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A3329%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.8 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
13
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:44:40 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
528f450bba4fb31a3de58ff7ff236742065a5b066f29e33d0cd1d5725236bd97
x-transaction
c0065877d1920dfc
expires
Tue, 31 Mar 1981 05:00:00 GMT
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:40 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
place
freestar-tagan.adlightning.com/ Frame 4248 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=0&d=eyJzaXRlSWQiOiJmcmVlc3RhciIsInVybCI6Imh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC8iLCJhZFVuaXQiOiIvMTUxODQxODYvYmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDg1OTQzODgwNiIsImNhbXBhaWduSWQiOiIyNjgwODI5NDc4IiwiY3JlYXRpdmVJZCI6IjEzODMwNzU0MzM2OSIsImxpbmVpdGVtSWQiOiI1MzM0MDM3ODg3IiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjMwMCwiaGVpZ2h0IjoyNTAsInd2IjoiMS4wLjArNWE5OWU1MCIsImJ2IjoiMS4wLjArNWE5OWU1MCIsInRhZ01hcmt1cCI6IjxodG1sPjxoZWFkPjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vZnJlZXN0YXIvYmwtZjgyMWE5NS1mY2U5ZWM2MC5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL2ZyZWVzdGFyL2ItNWE5OWU1MC0wZWY5MjVlMS5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0PndpbmRvd1tcIjIyMTc0NDI0X2ZyZWVzdGFyXCJdID0gd2luZG93W1wiMjIxNzQ0MjRfZnJlZXN0YXJcIl0gfHwge307d2luZG93W1wiMjIxNzQ0MjRfZnJlZXN0YXJcIl0udGFnRGV0YWlscyA9IHdpbmRvd1tcIjIyMTc0NDI0X2ZyZWVzdGFyXCJdLnRhZ0RldGFpbHMgfHwge1wic2l0ZUlkXCI6XCJmcmVlc3RhclwiLFwid3ZcIjpcIjEuMC4wKzVhOTllNTBcIixcInRvcERvbWFpblwiOlwiaHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vbmV3cy9zZWN1cml0eS9lbW90ZXQtbWFsd2FyZS1pcy1iYWNrLWFuZC1yZWJ1aWxkaW5nLWl0cy1ib3RuZXQtdmlhLXRyaWNrYm90L1wiLFwiY3VycmVudFRhZ0lkXCI6XCJhZGx0YWdfa3dzbDB0ajdfSlAzcE5ieWc5V1wiLFwiYXVcIjpcIi8xNTE4NDE4Ni9ibGVlcGluZ2NvbXB1dGVyXzMwMHgyNTBfMzAweDYwMF8xNjB4NjAwX1JpZ2h0XzNfMFwiLFwic2xvdEVsZW1lbnRJZFwiOlwiYmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zXCIsXCJhZFNlcnZlckRldGFpbHNcIjp7XCJhZHZlcnRpc2VySWRcIjpcIjQ4NTk0Mzg4MDZcIixcImNhbXBhaWduSWRcIjpcIjI2ODA4Mjk0NzhcIixcImNyZWF0aXZlSWRcIjpcIjEzODMwNzU0MzM2OVwiLFwibGluZWl0ZW1JZFwiOlwiNTMzNDAzNzg4N1wiLFwiYWRTZXJ2ZXJcIjpcImRmcFwifSxcIndcIjozMDAsXCJoXCI6MjUwfTt3aW5kb3cuYmxvY2tlciAmJiBibG9ja2VyKFwiMjIxNzQ0MjRfZnJlZXN0YXJcIiwgXCI8IS0tQURMX1dSQVBQRUQtLT5cIiwgZmFsc2UsIHdpbmRvdywge1wicmVmcmVzaE1lc3NhZ2VcIjpcInRydWVcIn0pOzwvc2NyaXB0PjwvaGVhZD48L2h0bWw%2BPCEtLSBJRlJBTUUgSU5ORVIgQ09OVEVOVCAtLT4iLCJtZXRhIjp7InBsUmF0aW8iOjAuMDEsImJsYWNrbGlzdFN0YXR1cyI6eyJsb2FkZWQiOnRydWUsInJlbW92ZWQiOmZhbHNlLCJjb3VudCI6NzM1fX19&i=1-1&t=adltag_kwsl0tj7_JP3pNbyg9W&r=3b9c53fbb5bca2fa221cfb49feb1d63&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1509
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
Ql7uVt_eRdVyNuvw4GGWCilZU7fsPX1P4iYAMvFRyrmQSzX-VGxX5A==
view
securepubads.g.doubleclick.net/pcs/ Frame 4248 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvpiLLhs-yxQm_xxQfoW6lOrrhZwKF0r8_4-entop2N2RC75lLR3zhTHsyxbVWYKAzwnPsGvCASkGYO0fcWoa8xUXxPVn_n85pp2Lu-xptEZV5wg87u-BMpup_mfJNPfcbbq5dsi0eSfVY9bMJNC7Wj_VRN73nywfIuva56kgMnkXh3FSFURc3nyEPLvJzADckqu2y38cgSefTcn3M3dQefN2TvhI7zJ4JMlWNHOvYl2dhSgduxyFEFeVCJe4KTUNZsMAS0crfB189pFtwG0lbhVQl85w3ThkFkCnduve-_wHG8fuSEwLaw6i1g7bMyCpVWdjYA1XMJaytKLc9Oe9hmItG4vUtzLiiiTJJU1abTzot0laE8Qw&sig=Cg0ArKJSzIGzTj56qE3GEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
dcmads.js
fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497147/dcm/ Frame 4248 		229 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497147/dcm/dcmads.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.60.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-60-129.compute-1.amazonaws.com
Software
/
Resource Hash
4a80bb3f691bba6f0b532713f0276cc41362c9d0a70fc651d2ca2e2d7d293647

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
content-encoding
gzip
vary
accept-encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
fw.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
expires
Wed, 31 Dec 1969 23:59:59 GMT
appnexus
ny1-bid.adsrvr.org/bid/feedback/ Frame 4248 		807 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ny1-bid.adsrvr.org/bid/feedback/appnexus?t=1&iid=a6bb0b9f-340b-4bd4-b92a-1fc651fcbf46&crid=8334xbua&wp=2.334858&aid=6310885541099408088&wpc=USD&sfe=13e39985&puid=8987304192775495297&tdid=&pid=3i8jb8j&ag=vpjkvsm&adv=m4cpndh&sig=1sEdqgqsJydwKTjfFeZIbYF3QcvYEJqrOSSI86XShSXc.&bp=2.33485747640821&cf=2716329&fq=0&td_s=www.bleepingcomputer.com&rcats=2dx,obk,jba,yvb,3gs&mcat=&mste=&mfld=4&mssi=&mfsi=&uhow=164&agsa=&rgz=H3B&svbttd=1&dt=PC&osf=Windows&os=Windows10&br=Chrome&rlangs=en&mlang=&svpid=7125&did=1267594&rcxt=Other&lat=45.499400&lon=-73.570300&tmpc=-7.25&daid=&vp=0&osi=&osv=&mk=Google&mdl=Chrome%20-%20Windows&c=CgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..&dur=CkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.&durs=y6VEMw&crrelr=&adpt=anor&ipl=bleepingcomputer_300x250_300x600_160x600_Right_3/bleepingcomputer_300x250_300x600_160x600_Right_3&pcm=1&vc=3&said=7480474431045220042&ict=Unknown&auct=1&im=1&mc=ad038fb7-631f-47ff-86ff-2afd5470d9af
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software
Kestrel /
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
cache-control
must-revalidate, no-cache
server
Kestrel
content-type
image/gif
transfer-encoding
chunked
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
ca
choices.truste.com/ Frame 4248 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=tradedesk01&aid=tradedesk01&cid=aw2wls7_vpjkvsm_8334xbua&c=tradedesk01cont1&js=pmw0&w=300&h=600&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-32.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
99243101e035d021001b593b30807c0fb87761ab8f57fc4e6f2db1d8db77712c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
content-encoding
gzip
server
nginx
x-amz-cf-pop
EWR53-C3
vary
Accept-Encoding, Origin
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 1e50ca9ac269e92d749f11227b12760d.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-id
02CDzuOmhvxfk0zvDeU6pnSTrso_3kayCmc8uYHz_l7Xf2W4UmHrWw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
moatad.js
z.moatads.com/thetradedeskv275874568748/ Frame 4248 		328 KB
111 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/thetradedeskv275874568748/moatad.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
762072bf05605eac7dbd75afd26a52645f467038fa9b8d75620fa942eff0685e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:41 GMT
content-encoding
gzip
last-modified
Tue, 02 Nov 2021 14:49:34 GMT
server
AmazonS3
x-amz-request-id
P9CGY8GFQNVSQYBX
etag
"cc32731696ee8344d5a0d79d0db0801d"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11122
accept-ranges
bytes
content-length
112750
x-amz-id-2
P5mvW7NJdo0AhfyKQDlBNs+dzrgEHg+b4jPGgv91mMfm/yegiaLrMc+3vRhn6LeqU/UqI4wAEWk=
trk.js
cdn.adnxs.com/v/s/221/ Frame 4248 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/221/trk.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5beecaeceee4fae5080c40d2ad96dd7c0b7e5a9bc242fbe2b99ab1276aaaae94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:41 GMT
Content-Encoding
gzip
Age
2821537
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
29240
X-Served-By
cache-lga21963-LGA, cache-yul12820-YUL
Access-Control-Allow-Origin
*, *
Last-Modified
Tue, 02 Nov 2021 09:57:21 GMT
Server
AkamaiNetStorage
X-Timer
S1638668681.123374,VS0,VE0
ETag
"f0105ab6d7d1878d827eb99659d44d8f:1635847041.806544"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Via
1.1 varnish, 1.1 varnish
Expires
Wed, 02 Nov 2022 09:59:04 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
2, 787122
it
nym1-ib.adnxs.com/ Frame 4248 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F&e=wqT_3QKZBvBMGQMAAAMA1gAFAQiFs7CNBhDYlYT76J6xylcYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJ36kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9LYBmAGsAqAB2ASoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAp5I4AKiz1zqAm1odHRwczovL3d3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbS9uZXdzL3NlY3VyaXR5L2Vtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QvgAMAiAMBkAMAmAMXoAMBqgMqGhM2MzEwODg1NTQxMDk5NDA4MDg4KgQyMDY1Og1vcnRiLTgzMzR4YnVhwAOsAsgDANgD--8Y4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjM3LjEyMC4yMDUuMTgyqAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANoEAggB4AQB8ASd-pCaAYgFAZgFAKAFyu3e7sn7_udnwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFqAP6BQQIABAAkAYAmAYAogYONzEyNSNOWU0yOjUyNzm4BgDBBgAAAAAAAPA_0AbE0AHaBhYKEAAAAAAAAAAAAAAAAEEL8FIQABgA4AYB8gZyCIqvTRJsQWhFTDlrMEFBQUFEQUFrQ0JRRUl4SmpuQnhEb2lyVUNHSkNha0FNZ0J5Z0FRTTZKb1FkSTVKQ2hCMUNITFZpZktYRQE8CQEUSGdBZ1FFCQwBAfA8SWdCQUpBQkFKb0JBZ2dBgAcBiAcAoAcBqgcHYXcyd2xzN7oHDwgAEAAYACAAMAA4sgRAAMgHv80F0gcNCQGuDAAASUABHgjaBwYJJ0TgBwDqBwIIAPAH2v8YiggCEAA.&s=46d01f912a55a3d06be1c4e355e54abf02e1b782
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:41 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
f6c86e6a-dbb8-4429-8b0c-8e4b5accee67
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame ADE7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv8rf1-u_KoIcb0LGcCDzzHa5MteSQ9U2cJwMjfAe5SoxIHZJmVue5-Ke1zhmCbc7dr6KKY0N44EjwgVqhM7A61ZD8KAzXdx1AOL_P-dOs3B23cOf0ijpLXSAB9D_71pYPd5bXX2JK7dey6mOQvhV2brf0thC3QVXs9a9F_fXy9ig2aSDVTvuzm97ukMB0zOTqZxv6gDoEQ0OIeJrBFo9JQtJH5vPKNwQi4qxJR35Yh6n0OyjPHfKuaduUNcKPD9l4amEnEObJboNhPQmo_9PJl8UT3oGiU6oKGDGgSEnVAgmzz7NAOaBRoA1udmCK4bJQ-xBWJyGrxd5_zBydFGRFtks4sISjSDC63JWl-mAHDSRtQPo9eun0&sig=Cg0ArKJSzL4qJ0hCMmifEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
dcmads.js
fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497149/dcm/ Frame ADE7 		229 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fw.adsafeprotected.com/rjss/www.googletagservices.com/877959/58497149/dcm/dcmads.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.4.60.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-4-60-129.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8060b94c7429a7e4c4ba3d5c1f31f25713b673753f1509db9c9e852a3b0f3070

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
content-encoding
gzip
x-server-name
app06.va.303net.net
content-type
application/javascript;charset=utf-8
access-control-allow-origin
fw.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
expires
Wed, 31 Dec 1969 23:59:59 GMT
appnexus
ny1-bid.adsrvr.org/bid/feedback/ Frame ADE7 		807 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ny1-bid.adsrvr.org/bid/feedback/appnexus?t=1&iid=cb4f6517-8ebb-4b3f-9a53-8d7653aefd9e&crid=lw2q2t7y&wp=2.334858&aid=8265286578579222210&wpc=USD&sfe=13e39985&puid=8987304192775495297&tdid=&pid=3i8jb8j&ag=vpjkvsm&adv=m4cpndh&sig=1RCZas5SEucewMazsmQAehoJujASTVxGwB2J4aLareUU.&bp=2.33485747640821&cf=2716329&fq=0&td_s=www.bleepingcomputer.com&rcats=2dx,obk,jba,yvb,3gs&mcat=&mste=&mfld=4&mssi=&mfsi=&uhow=164&agsa=&rgz=H3B&svbttd=1&dt=PC&osf=Windows&os=Windows10&br=Chrome&rlangs=en&mlang=&svpid=7125&did=1267594&rcxt=Other&lat=45.499400&lon=-73.570300&tmpc=-7.25&daid=&vp=0&osi=&osv=&mk=Google&mdl=Chrome%20-%20Windows&c=CgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..&dur=CkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.&durs=y6VEMw&crrelr=&adpt=anor&ipl=bleepingcomputer_728x90_970x90_970x250_320x50_BTF/bleepingcomputer_728x90_970x90_970x250_320x50_BTF&pcm=1&vc=3&said=7480474431045220042&ict=Unknown&auct=1&im=1&mc=ad038fb7-631f-47ff-86ff-2afd5470d9af
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software
Kestrel /
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:40 GMT
cache-control
must-revalidate, no-cache
server
Kestrel
content-type
image/gif
transfer-encoding
chunked
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
ca
choices.truste.com/ Frame ADE7 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=tradedesk01&aid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&c=tradedesk01cont1&js=pmw0&w=728&h=90&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-32.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
6b3dadacf3fa028c53f78d0b543b15203609955b2bab711a6f659ef8eec1fa3d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 21:42:42 GMT
content-encoding
gzip
server
nginx
age
14519
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 1e50ca9ac269e92d749f11227b12760d.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C3
x-amz-cf-id
-O-birs1Ughj8d9i4Tb_7z9yKMIOOEb0LkVCYAKFURrkHpvVROWMOA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
moatad.js
z.moatads.com/thetradedeskv275874568748/ Frame ADE7 		328 KB
111 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/thetradedeskv275874568748/moatad.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
762072bf05605eac7dbd75afd26a52645f467038fa9b8d75620fa942eff0685e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:41 GMT
content-encoding
gzip
last-modified
Tue, 02 Nov 2021 14:49:34 GMT
server
AmazonS3
x-amz-request-id
P9CGY8GFQNVSQYBX
etag
"cc32731696ee8344d5a0d79d0db0801d"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11122
accept-ranges
bytes
content-length
112750
x-amz-id-2
P5mvW7NJdo0AhfyKQDlBNs+dzrgEHg+b4jPGgv91mMfm/yegiaLrMc+3vRhn6LeqU/UqI4wAEWk=
trk.js
cdn.adnxs.com/v/s/221/ Frame ADE7 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/221/trk.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5beecaeceee4fae5080c40d2ad96dd7c0b7e5a9bc242fbe2b99ab1276aaaae94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:41 GMT
Content-Encoding
gzip
Age
2821537
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
29240
X-Served-By
cache-lga21963-LGA, cache-yul12820-YUL
Access-Control-Allow-Origin
*, *
Last-Modified
Tue, 02 Nov 2021 09:57:21 GMT
Server
AkamaiNetStorage
X-Timer
S1638668681.285547,VS0,VE0
ETag
"f0105ab6d7d1878d827eb99659d44d8f:1635847041.806544"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Via
1.1 varnish, 1.1 varnish
Expires
Wed, 02 Nov 2022 09:59:04 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
2, 787123
it
nym1-ib.adnxs.com/ Frame ADE7 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F&e=wqT_3QKXBvBMFwMAAAMA1gAFAQiFs7CNBhDC3ZKYocuM2nIYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9KgBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAqLPXOoCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC-AAwCIAwGQAwCYAxegAwGqAyoaEzgyNjUyODY1Nzg1NzkyMjIyMTAqBDIwNjU6DW9ydGItbHcycTJ0N3nAA6wCyAMA2AP77xjgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMzcuMTIwLjIwNS4xODKoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAElvqQmgGIBQGYBQCgBcrt3u7J-_7nZ8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBagD-gUECAAQAJAGAJgGAKIGDjcxMjUjTllNMjo1Mjc5uAYAwQYAAAAAAADwP9AGxNAB2gYWChAh_S4BAPBSEAAYAOAGAfIGcgiKr00SbEFoRUw5azBBQUFBREFBa0NCUUVJeEpqbkJ4RG9pclVDR0pDYWtBTWdCeWdBUU02Sm9RZEk1SkNoQjFDSExWaWZLWEUBPAkBFEhnQWdRRQkMAQHwPElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoHB2F3Mndscze6Bw8IABAAGAAgADAAOLIEQADIB7_NBdIHDQkJtgRJQAEeCNoHBgknROAHAOoHAggA8Afa_xiKCAIQAA..&s=93a1de81de85efca4f82177b5f94ff21e188ad05
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:41 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
47eac54a-f03d-4b97-aa9a-f72973404eac
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 0A31
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 05 Dec 2021 01:44:41 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sun, 05 Dec 2021 01:44:41 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 05 Dec 2021 01:44:41 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 617F 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113353
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame F0A3
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497149/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuildin...
  • https://www.googletagservices.com/dcm/dcmads.js
9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:03:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2487
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4486
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 19:29:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:03:14 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
app01.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
location
https://www.googletagservices.com/dcm/dcmads.js
cache-control
no-cache
content-length
0
server
nginx
sca.17.5.12.js
static.adsafeprotected.com/ Frame 0EE3 		80 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.5.12.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:be00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 19 Aug 2021 16:31:41 GMT
content-encoding
gzip
age
9277981
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Thu, 19 Aug 2021 16:31:24 GMT
server
AmazonS3
etag
W/"9304f57298c3834ff107ea7ccb547996"
vary
Accept-Encoding
x-amz-version-id
9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via
1.1 47f167ca4b48d927b2e7abade7ebfcfd.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
EWR53-C2
content-type
application/javascript
x-amz-cf-id
8PMRzXfrdC_Wicpb7sl344_GtffYOwJeNpHEfpqwIiEY8tH9ykgxRw==
dcmads.js
www.googletagservices.com/dcm/ Frame 5491
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497149/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuildin...
  • https://www.googletagservices.com/dcm/dcmads.js
9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:03:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2487
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4486
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 19:29:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:03:14 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
app34.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
location
https://www.googletagservices.com/dcm/dcmads.js
cache-control
no-cache
content-length
0
server
nginx
sca.17.5.12.js
static.adsafeprotected.com/ Frame E6DF 		80 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.5.12.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:be00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 19 Aug 2021 16:31:41 GMT
content-encoding
gzip
age
9277981
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Thu, 19 Aug 2021 16:31:24 GMT
server
AmazonS3
etag
W/"9304f57298c3834ff107ea7ccb547996"
vary
Accept-Encoding
x-amz-version-id
9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via
1.1 47f167ca4b48d927b2e7abade7ebfcfd.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
EWR53-C2
content-type
application/javascript
x-amz-cf-id
-pCBVG0DjShhPlkl2IWyGMutf1Wz-B-QOf2dyziHjIZMMNHQq4spIQ==
jot
syndication.twitter.com/i/ Frame 3F7F 		43 B
170 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638668681469%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-1%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460308766767915013%22%5D%2C%22item_details%22%3A%7B%221460308766767915013%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A4079%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.8 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
11
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:44:41 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
528f450bba4fb31a3de58ff7ff236742065a5b066f29e33d0cd1d5725236bd97
x-transaction
3939ed9fba1c5f18
expires
Tue, 31 Mar 1981 05:00:00 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame 08B5
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497151/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuildin...
  • https://www.googletagservices.com/dcm/dcmads.js
9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:03:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2487
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4486
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 19:29:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:03:14 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
app15.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
location
https://www.googletagservices.com/dcm/dcmads.js
cache-control
no-cache
content-length
0
server
nginx
sca.17.5.12.js
static.adsafeprotected.com/ Frame C2BD 		80 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.5.12.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:be00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 19 Aug 2021 16:31:41 GMT
content-encoding
gzip
age
9277981
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Thu, 19 Aug 2021 16:31:24 GMT
server
AmazonS3
etag
W/"9304f57298c3834ff107ea7ccb547996"
vary
Accept-Encoding
x-amz-version-id
9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via
1.1 47f167ca4b48d927b2e7abade7ebfcfd.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
EWR53-C2
content-type
application/javascript
x-amz-cf-id
P6ubtXgJAEGfb_HW07a18HOHZvujFD9WxKvHpb1CD2bQXLjqIy1ljg==
view
googleads4.g.doubleclick.net/pcs/ Frame 5C28 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss4Ven__LFNfE_8n0awcqb-ej4_QgcCX11Df3xdsVxnuaXk1K-Bj7MktAh_-E-URBkO6iuDY3oOxUQoxs6vJXKF9xB2yuJofQHz-zh0m34a-9HZML5YGXToQRyTe2aRu4gBZeSYi9RdBP-2XLozk7ywvjbji0YX8LChHRCvw2uI2Ao7CIvZj7RDHNxlx7bpIrGDZgPudgV-ztuAKBL7CSbIpyYoRAnLr3ERK4ThnDKvvdrxfWfJAXth6Ganz8uCAz2hUwcyw-VEaUdKInjn29_kJGSuI6_K-1-WeFzFlleNpijvE4YhC9pzIjwJ6iKfo_wJcQ9k1EcTrZv0mpI5SnMRflx2s6fCxTmClbqvBbxS-f6Vvo_Fg1gPtoNJSZBfzl9pB1LzdfZuzOauT2WHhfw-q1fO7iTqOqlAGqAExAQdvm8IOunkVlpR21luz4KMVL6gnTluTf6lLxEMEVM69k7FqgEqNqqiXz7YY-FXTJG_Qy8GixhBCB9G9CozLQyY19e-6nWZ865RLIQGI330vEmjnZ1SVQSC1Kb43VMWIzm46c9edUJnC-L89F5TNQeE_gLqPI0u4mARcriaZdXnefDVKaj3sxldzJwip3-RPcptz9zTKE5N2p8O6lAXrk36XE5i7serHhtmeJwG5iksGOJZ5lTLnHsJB1mcP6gUQRlvLK6gogEnAbl9LOYUrjmjH9Q25lYbueic-E2CBpoXlbfTgIPbBu6d--7-ZbitBzN0k6t7CGlBA9yq6lHr2AsF5BlRKP7Q6rLb-qh3R8OqbTiQY7RwPT1UK2Gsv3I7h-t-BBoXCwP65eJphNkEgHA3vOuPar2HPBh8gsk2gttHDmYZQaF6kVJaDLornbiDasTaP45xBaSfOUzJ-wT4v7Si2gc_cQ8F7O6QTD1jMXBJblHJxrRhGDMuMa7sLUS6-Apm_oTUNd2Wux4FgalQ3Hsb1jaGF7bYfILehe0NsX7uBYHurN3UxF-x3O8lT3gerLWuLi-kne4y44psoF-T4uSayStiYf-CeUnaHBvsEUYuS7M2mCvXb0l3yL_cBb_OylHwYV_8w5kCseFFyqlj1rmeY2lE6-P57XFnsqflJ34m7Com6vKodJ907oohH4JAboUZGLwBmxwUXBwjZMDTpg3twK_2eHVEmQcGnaBCN3eHYQlkvxBwi60bTdeEIWQe475qI_dR08cT9z8ss41dzd2-xjZezgbpZJxU78G4wsNlZLMd2rT-nw&sai=AMfl-YS7_fv_cuRFu9AqCQxbUvIzH7XZ-qYgkPwYQiUMT8h6NTqprvxNQ1QKuwdrAyucdk7VqJn4pJbN5m-5j3eNJOcf7gWbwu5PFdoSM51u_w5fOt5RpK0rZ9x9LipaM-9_v9wZx5GXzBnk8DsluHoGkdqdkw7u2Q&sig=Cg0ArKJSzNPph903nSCtEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=691&vt=11&dtpt=690&dett=2&cstd=0&cisv=r20211201.89332&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Br6BhyCvGWiyc37L0IdDya9kg36GKbhsDYLZVhJAumP24PsFib1i_uXbzRaOtwAH06gzKLYFZMLrVorOLX-nyosHgXafcR_lh8ANSRbRGdgR3ocuGhKQpk0DXt6nXLlzYeooKNnNJcovHg79Uk2x-xTGLsqQ&dbm_d=AKAmf-D3bOlLWl_GQFJ9MD7soIDXVpvseKVhKS3w4xmOXliC79yh73laAcTuZgLkv076gmr1CL9Qq_VITFl1JgY5Ue3DKVtO3K4I7Y_nHrc_r-fTJvbW4gqpq-3R80jF-JBEd-mddFEyt1pqtB5D2yvgLfLAGZxHHMTaRRAZWOYuSroQ5bccdJfc698lW8jC2daj5Wdbb-19VZWSl_P4B25QhO1FLn_J7XzIYQmnv_OHut7Dr36j1uQ8p0fQDbXcKOwr5hZ92cK-uVK9DtxoTf83B_y5sr0_Kw8UnpdOmL-dLNrNTvp6c3xDQbjIZy9qieOzhnHd4HXXLZX1khRTBgT-AQlWcZH0oVhk2Y9jNCSXaxsXqk241-bfLZD67f_QZ3LniBkVuN7xOBnL76qP_adp48FVMcDMKmTc85JKiMk-CVe7YQudV-pWEyEdaisbZE0hGVrIQp2Q5NUw9eOmv3WvcuYo-o7Ex5YrBCBPMHjedFBq7i_RjOPg0g6B9Df9Jo7L9lkKntcETWBqafuiAjrfalazdZOeKjD2ni_14o4vnBwjKWEbIZr0v-7Do6n48TAQjKT5eGT03Z5fQUH-qnwct9EAzDFilBAzbffJuY_t7Odp_pvmegO1JemCHc_UXseAKRlAWQ8rObz7kOQbY61-J1pJVtV96Ucx-eOZBYbrGNff9kPm1k1jJXFnWpPQI0U0X8ZLL7XEEDUs0bhcx3AbH3AWYSQb6TGgEa9ULV7oDev9s1DrCetAFArjCdU6e7PeVFrAPWTkNTwOh3Nnk22KbltZQeLbtdAV7fe1VjDmQn20Q569APP4ivcc_HnB13v7lNzm3N6sRPMop7ePNAh8HrGcg2jyrZ6JZ_LNczrokogyWmR5vPcVzWDZkFrkocBYlry6d_Pjtf6ORzK0M6BrqfeMr6GW3sDgaQA5hNf5CX6OHMn1HHTmie6XGuVNzsPOyq4eGWI870RpwLgFAgqnDFzYkMm5k7DIrnVO4rAC4euTlZY_z4hxFsfpRv3lFJEc9KS7loHX6lSG1JXOWMrv24Tn9_KMGDJiArhAr01QzuGANOJ24FmKe58BgwFZhIh0rMIh_iPFLQTCbKHCpvf_sgilDG2h5fO7NJtyxcBt8XPb_aKF2IDZnOXZCYPYGEhAFqyKRJnwZODK2_k4WZZqqbcS7mchTKHj-su-iJnrOtRgUjEt-x_uQEs2fNLfeo-Z3pPHAu-AnuQXzsCj_ih6hUVpUo9wJF2o_Ya7U3XGNPmvHuyvRAzsBYCfkQkelY9DOz0gq_6qRwI4pu00UqT1x9sC5DIiE2WJ6TFiM9F5IVftPZzFW5FHf6IGkGjVrLCKNdiQzvmCT1ws5ZMPwfZ3V8C99mNtE6AkBTzre9v9At14eYuaHQow-fsu2A1ZH5s3BED4qVuSuuPC83HVa9rYo1LCCLIlOiTiBh0qT6GdK5Lo4oLc0d28iHM7L8EhKQ0JPkKonTIBjJAnyrSbzSLifGVc2AuqgQdGlvquthdNy2g_z8bh0XxDhQRJ2Av-U3xZaz9gRfytfEi0ty2hIdnH3XToE2XMDSkBmU7kYN-qJg_Jovjwx_4PIa9UUoHBotWH0w4uJgAaHfYI0F7OPYiI-9IGeEwX59oSbTeuZ36swAZZ8H6As1CSwP5UpoXiRojBeKkm40NRnZRNe_On0afLDCxRbjqoDXtwXqOsaSbE4u-CJ_bkQXB1mA05EAFxPsLAa6c-dwkeWm9_-RBqnmmROC6fE3u8uiobkOMFCQfkhtAtGz8LYMvSCmLF31OA9tLkVGP56IMnz_ejkB2X-MfxQ5ecIN6F4a5CK36okfeM-ZaK9W4JEXUYnuiuzPA-EmUSv9pzvizLSJo4J8vIZ-n2IIHkeCzQZ1UmxwDXgSC1VvIfmwvERWcOnuXHOpNC6icuvWKO_G4ZEgbimrMUDoJIB88K1CeDKpt57qJGEBAye5dTDDYeh3qDAQH6gYKZHIVr1iCoF4WQs2VrmG7i6VQdNMlTqzXpai9n3YuMwGxGfc0Zb-No8gzNrQySbKu6_bfgGDLqYO7vHBYWNTQvGeL-xs9LcqOwpQ3bl0Z-jWfUSbcxNvZVgKsubKhZltLKT8-U-Tb8E0oWqWqdK7kU24Q67FE5GiatMivf_tAZcZY-EiHTJ6AzmoUF7fzJT95gduh95KwJDVistMBy5ZeXqrE3Iuy1vBWaV-opcBjjmByrVSEU-SNeSoPPJeU9BQxI7mPmJi9Oi6G2UVNow2DBXVJW00RLWG-rmANON4x8aT4iONQQ4yum-Z1Y4BDsi4QsPtEKUO1pY3-YR2p5emZ-6AOUvGJpgVTd9tFvty2eetYUSN-8uhTV3KQ0jOaKJbW9t4t82H6_Q-lQ3BX5rL1Avsx3OvJ87fgo_5cwZneP7I3d8VKn56wZIfnowQR95GV2rdgzhjfZBqKAsufQ8Qv2Jtfu4LqOtW5WKEMvMNwU9vefcuSUDNqWHZla1REleT3OFcbKZRscikCcN52BLPcdQ6TU0XHOP5UZyoToHtkjlvbzccJKIr_dy4D3liYt7KDsKRc5hPxImEcgKY6m7hVu6A-_Wp7wxs7LXus_ugvpVGkCJ0jyhEIE9E_5Z0TWJbB2BPnvjZgkiTZXgNr62C3UZ-3h0Dd-2p2UllI6bCmfqJ6Gvun9mNv0SDSV6yV057Mbg1PSppX84bKRHylzw16qh60IVSza2DYV_Rq09_9Uszudu7bWeHWcbRSdgb6_zhnUWJMKhML7kKt71ACGIFSUDbTM1Vck2F-GAO57sRcA-5Rw_EcMSN7lTgSxiDXgRyx7aFopOrXmkZ96MAtsOm60rdFkclwIy7quCC6mo_hP17rNQDWMRBGnLtA5sxZ1zbXkNNJ1YCD1kZotlrCOt24rb29FsS3RnMIND5OTqEDwNO5t5k5wVmE8d61Z5L8D7uEEv0CamtQiNtKtaKF3eqgkwGJSlaS30ZUcTsnSQjTG-GqwvTtcca-pKGvz1ZtuHV5eamFPLb1JLjL8sZatydEUbDJVtq-eWyRy8w9gQGgprc_mAo-F9bsGtWU7GyNEf8gfHqhvsdz9FOMZzvWmF6FbdnkPVQo3zlKu_xqSSGQCyxtsZffuJbrRvn8QefiBXkun0tFr8xGXxj7nyXwP2Fdb_pckJCBNbKLurg&cid=CAASEuRodiUmuomIdaeWxgDcxuY7PQ&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:41 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:41 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
abt
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:40 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
dcmads.js
www.googletagservices.com/dcm/ Frame 4248
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497147/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuildin...
  • https://www.googletagservices.com/dcm/dcmads.js
9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:03:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2487
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4486
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 19:29:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:03:14 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
app20.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
location
https://www.googletagservices.com/dcm/dcmads.js
cache-control
no-cache
content-length
0
server
nginx
sca.17.5.12.js
static.adsafeprotected.com/ Frame FDD5 		80 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.5.12.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:be00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 19 Aug 2021 16:31:41 GMT
content-encoding
gzip
age
9277981
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Thu, 19 Aug 2021 16:31:24 GMT
server
AmazonS3
etag
W/"9304f57298c3834ff107ea7ccb547996"
vary
Accept-Encoding
x-amz-version-id
9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via
1.1 47f167ca4b48d927b2e7abade7ebfcfd.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
EWR53-C2
content-type
application/javascript
x-amz-cf-id
pIltdmo4502g_aOoy5JjaTHwnLeZNba53vHAuPgtYVzer2XOwYsQPg==
dcmads.js
www.googletagservices.com/dcm/ Frame ADE7
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/www.googletagservices.com/877959/58497149/dcm/dcmads.js?adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuildin...
  • https://www.googletagservices.com/dcm/dcmads.js
9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:03:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2488
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4486
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 19:29:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:03:14 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
app12.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
location
https://www.googletagservices.com/dcm/dcmads.js
cache-control
no-cache
content-length
0
server
nginx
sca.17.5.12.js
static.adsafeprotected.com/ Frame AAFD 		80 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.5.12.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:be00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 19 Aug 2021 16:31:41 GMT
content-encoding
gzip
age
9277981
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
PENDING
last-modified
Thu, 19 Aug 2021 16:31:24 GMT
server
AmazonS3
etag
W/"9304f57298c3834ff107ea7ccb547996"
vary
Accept-Encoding
x-amz-version-id
9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via
1.1 47f167ca4b48d927b2e7abade7ebfcfd.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
EWR53-C2
content-type
application/javascript
x-amz-cf-id
xo8bRyFGnkDOz0HO8MxDUwO8r9MmIlg6AK9eurEhgcHbAdZsSUAVuA==
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9ef1eab2-63bf-ab8a-ec9f-720656398207&tv=%7Bc:vSM0ye,pingTime:-2,time:496,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:1174,mdZ:1316,beA:2025,beZ:2026,mfA:2028,cmA:2029,inA:2029,inZ:2045,prA:2045,prZ:2055,si:2063,poA:2067,poZ:2093,cmZ:2093,mfZ:2093,loA:2306,loZ:2310,ltA:2519,ltZ:2519%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:38%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:496,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B489~0%5D,as:%5B489~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n*.877959-58497149%7C1o.877959-58497149%7C1p.877959-58497151%7C1q%7C1r%7C1s,idMap:1n*,rmeas:1,rend:0,renddet:IMG.us,slid:%5Bgoogle_ads_iframe_/15184186/bleepingcomputer_728x90_970x90_970x250_320x50_ATF_0,google_ads_iframe_/15184186/bleepingcomputer_728x90_970x90_970x250_320x50_ATF_0__container__,bleepingcomputer_728x90_970x90_970x250_320x50_ATF%5D,sinceFw:452,readyFired:true%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
dt03.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ 		43 B
216 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=fbeef6d0-9e2b-05d0-75e9-91e9adffb828&tv=%7Bc:vSM0yl,pingTime:-2,time:432,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:1295,mdZ:1352,beA:2050,beZ:2052,mfA:2053,cmA:2055,inA:2055,inZ:2070,prA:2070,prZ:2081,si:2093,poA:2097,poZ:2127,cmZ:2127,mfZ:2127,loA:2297,loZ:2301,ltA:2482,ltZ:2482%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:37%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:432,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:268.5433.728.90,am:i,cc:268.5433.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B426~0%5D,as:%5B425~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n.877959-58497149%7C1n1%7C1o*.877959-58497149%7C1p.877959-58497151%7C1q%7C1r%7C1s,idMap:1o*,rmeas:1,rend:0,renddet:IMG.us,slid:%5Bgoogle_ads_iframe_/15184186/bleepingcomputer_728x90_320x50_InContent_1_0,google_ads_iframe_/15184186/bleepingcomputer_728x90_320x50_InContent_1_0__container__,bleepingcomputer_728x90_320x50_InContent_1%5D,sinceFw:385,readyFired:true%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
dt02.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 66BE 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 19:21:13 GMT
expires
Sun, 05 Dec 2021 19:21:13 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
23008
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 5C28 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b8d92954490ffc41ab2023c7045e8d452d64e17826ebdc8f607b5fc97f0d83ee

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
optout_check
beacon.krxd.net/ 		92 B
252 B 		Script
General
Check archive.org
Download Go to
Full URL
https://beacon.krxd.net/optout_check?callback=Krux.ns.investingchannelinc.kxjsonp_optOutCheck
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
538605b11db372d2a91449ee4290c7c782fa348f7264d7e74acc48cdcb2059bf

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:41 GMT
cache-control
private, max-age=0, s-max-age=0
x-request-time
D=22 t=1638668681
x-served-by
beacon-n024-ash-prod.krxd.net
content-type
text/javascript
get
cdn.krxd.net/userdata/ 		374 B
517 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/userdata/get?pub=9427dd0d-835c-471c-a5db-ab01ae8a681c&technographics=1&callback=Krux.ns.investingchannelinc.kxjsonp_userdata
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fd2022bb1ec064ea24325b1fa9503e8766a3f90cc30a25f19ee5c7926d4ae074

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_userdata_ash_prod_krxd_net___UserData_Service_V2
date
Sun, 05 Dec 2021 01:44:41 GMT
content-encoding
gzip
age
0
x-served-by
userdata-a003-ash-prod.krxd.net, cache-yul12826-YUL
vary
Accept-Encoding
x-cache
MISS, MISS
content-type
text/javascript
via
1.1 varnish
cache-control
private, max-age=1800
x-age
0
accept-ranges
bytes
x-timer
S1638668682.917025,VS0,VE20
content-length
289
x-cache-hits
0, 0
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=44b263a8-3dc5-6d0b-919c-cf65caeccc4c&tv=%7Bc:vSM0A7,pingTime:-2,time:444,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:1426,mdZ:1476,beA:2120,beZ:2122,mfA:2124,cmA:2125,inA:2125,inZ:2141,prA:2141,prZ:2153,si:2162,poA:2166,poZ:2196,cmZ:2196,mfZ:2196,loA:2363,loZ:2368,ltA:2563,ltZ:2563%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:41%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:444,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:41,wc:0.0.1600.1200,ac:1082.1627.300.250,am:i,cc:1082.1627.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B437~0%5D,as:%5B437~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n.877959-58497149%7C1n1%7C1o.877959-58497149%7C1o1%7C1p*.877959-58497151%7C1q.877959-58497147%7C1r%7C1s,idMap:1p*,rmeas:1,rend:0,renddet:IMG.us.bi,slid:%5Bgoogle_ads_iframe_/15184186/bleepingcomputer_300x250_300x600_160x600_Right_2_0,google_ads_iframe_/15184186/bleepingcomputer_300x250_300x600_160x600_Right_2_0__container__,bleepingcomputer_300x250_300x600_160x600_Right_2%5D,sinceFw:396,readyFired:true%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
x-server-name
dt08.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
usermatch.gif
beacon.krxd.net/ Frame 69F7
Redirect Chain
  • https://usermatch.krxd.net/um/v2?partner=google
  • https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T2hZcF9EN0Y
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private, no-cache, no-store
x-request-time
D=17 t=1638668682
x-served-by
beacon-n004-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
291
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usermatch.gif
beacon.krxd.net/ Frame 69F7
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T2hZcF9EN0Y
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private, no-cache, no-store
x-request-time
D=30 t=1638668682
x-served-by
beacon-n031-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEH2Kj52N1BJbNNUsUM4-szI&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
291
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usermatch.gif
beacon.krxd.net/ Frame 69F7
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=OhYp_D7F&gdpr=0
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=7de5ca57-c954-4db1-bc90-ae26323dfac5
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private, no-cache, no-store
x-request-time
D=29 t=1638668682
x-served-by
beacon-n035-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=7de5ca57-c954-4db1-bc90-ae26323dfac5
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
227
379708.gif
idsync.rlcdn.com/ Frame 69F7 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/379708.gif?partner_uid=OhYp_D7F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:42 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
usermatch.gif
beacon.krxd.net/ Frame 69F7
Redirect Chain
  • https://stags.bluekai.com/site/26357?id=OhYp_D7F&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOhYp_D7F%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID
  • https://beacon.krxd.net/usermatch.gif?_kuid=OhYp_D7F&partner=bluekai&bk_uuid=$_BK_UUID
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?_kuid=OhYp_D7F&partner=bluekai&bk_uuid=$_BK_UUID
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private, no-cache, no-store
x-request-time
D=27 t=1638668682
x-served-by
beacon-n025-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
https://beacon.krxd.net/usermatch.gif?_kuid=OhYp_D7F&partner=bluekai&bk_uuid=$_BK_UUID
Date
Sun, 05 Dec 2021 01:44:42 GMT
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
p
sb.scorecardresearch.com/ Frame 69F7 		64 B
444 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/p?c1=9&c2=8188709&cs_xi=OhYp_D7F&rn=1638668682
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-85.ewr50.r.cloudfront.net
Software
/
Resource Hash
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
via
1.1 724c8c129f28bfce25c0430050f1ae72.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
etag
W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache
Miss from cloudfront
content-type
image/gif; charset=utf-8
content-length
64
x-amz-cf-id
NPx3aiYsQh8E3yf7wNvKmzzuhueKTbC9PXJ-ZQRDYdYliX_RsZNDhw==
match
ps.eyeota.net/ Frame 69F7 		0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?bid=i0r4o4v&uid=OhYp_D7F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-207-77-150.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:42 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
usermatch.gif
beacon.krxd.net/ Frame 69F7
Redirect Chain
  • https://ib.adnxs.com/getuid?https://beacon.krxd.net/usermatch.gif?adnxs_uid=$UID
  • https://beacon.krxd.net/usermatch.gif?adnxs_uid=8987304192775495297
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?adnxs_uid=8987304192775495297
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private, no-cache, no-store
x-request-time
D=25 t=1638668682
x-served-by
beacon-n007-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:42 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
b4f307b5-6881-4934-a027-65f606ec2fbc
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://beacon.krxd.net/usermatch.gif?adnxs_uid=8987304192775495297
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
image.sbxx
ib.mookie1.com/ Frame 69F7
Redirect Chain
  • https://global.ib-ibi.com/image.sbxx?go=247532&pid=314&xid=OhYp_D7F
  • https://ib.mookie1.com/image.sbxx?go=247532&pid=314&xid=OhYp_D7F
120 B
982 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.mookie1.com/image.sbxx?go=247532&pid=314&xid=OhYp_D7F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
64.58.232.180 , United States, ASN13649 (ASN-VINS, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
42b601bc0d93dfca6e350b46d113bf8e7ff9e40a87a0c57ab9b3c9c219062423

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:42 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
p3p
CP=\"DSP COR ADM DEV PSA PSD OUR\", CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
LAS12
Content-Type
image/png
Content-Length
120
Expires
-1

Redirect headers

Date
Sun, 05 Dec 2021 01:44:41 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Location
https://ib.mookie1.com:443/image.sbxx?go=247532&pid=314&xid=OhYp_D7F
p3p
CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin
*
Cache-Control
private
X-Server
LAS14
Content-Type
text/html; charset=utf-8
Content-Length
193
usermatch.gif
beacon.krxd.net/ Frame 69F7
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dpubmatic%26partner_uid%3D%23PM_USER_ID
  • https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private, no-cache, no-store
x-request-time
D=30 t=1638668682
x-served-by
beacon-n022-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396
date
Sun, 05 Dec 2021 01:44:41 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
398696.gif
idsync.rlcdn.com/ Frame 69F7
Redirect Chain
  • https://fei.pro-market.net/engine?mimetype=img&du=88&csync=OhYp_D7F
  • https://idsync.rlcdn.com/398696.gif?partner_uid=-3328909297190025284
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/398696.gif?partner_uid=-3328909297190025284
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:42 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
via
1.1 google
server
Apache-Coyote/1.1
access-control-allow-origin
*
anserver
gapp3.c.datonics-gcp-01.internal
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location
https://idsync.rlcdn.com/398696.gif?partner_uid=-3328909297190025284
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
content-length
0
expires
Mon, 1 Jan 1990 0:0:0 GMT
impl_v81.js
www.googletagservices.com/dcm/ Frame F0A3 		41 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v81.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 08:03:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
150087
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17189
x-xss-protection
0
last-modified
Mon, 18 Oct 2021 20:08:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 08:03:15 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame FFFA
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 05 Dec 2021 01:44:42 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 05 Dec 2021 01:44:42 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 734D 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113354
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 675F 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
230779
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
impl_v81.js
www.googletagservices.com/dcm/ Frame 5491 		41 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v81.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 08:03:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
150087
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17189
x-xss-protection
0
last-modified
Mon, 18 Oct 2021 20:08:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 08:03:15 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9a0fbde3-9ae8-f13c-53d9-a0aff1deee14&tv=%7Bc:vSM0CK,pingTime:-2,time:450,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:1304,mdZ:1343,beA:1824,beZ:1825,mfA:1827,cmA:1828,inA:1828,inZ:1843,prA:1843,prZ:1856,si:1864,poA:1868,poZ:1894,cmZ:1894,mfZ:1894,loA:2075,loZ:2080,ltA:2273,ltZ:2273%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.600,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:600,t:39%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:450,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:1082.2329.300.600,am:i,cc:1082.2329.300.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B444~0%5D,as:%5B444~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n.877959-58497149%7C1n1%7C1o.877959-58497149%7C1o1%7C1p.877959-58497151%7C1p1%7C1q*.877959-58497147%7C1r.877959-58497149%7C1s,idMap:1q*,rmeas:1,rend:0,renddet:IMG.us,slid:%5Bgoogle_ads_iframe_/15184186/bleepingcomputer_300x250_300x600_160x600_Right_3_0,google_ads_iframe_/15184186/bleepingcomputer_300x250_300x600_160x600_Right_3_0__container__,bleepingcomputer_300x250_300x600_160x600_Right_3,pinned%5D,sinceFw:405,readyFired:true%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
x-server-name
dt01.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
impl_v81.js
www.googletagservices.com/dcm/ Frame 08B5 		41 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v81.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 08:03:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
150087
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17189
x-xss-protection
0
last-modified
Mon, 18 Oct 2021 20:08:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 08:03:15 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=f3e67bff-2ad3-5ea8-e308-f3f0ed0d8a54&tv=%7Bc:vSM0Db,pingTime:-2,time:380,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:1439,mdZ:1481,beA:1893,beZ:1894,mfA:1896,cmA:1898,inA:1898,inZ:1913,prA:1913,prZ:1924,si:1932,poA:1935,poZ:1963,cmZ:1963,mfZ:1963,loA:2193,loZ:2197,ltA:2272,ltZ:2272%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:ins%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:38%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:380,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:38,wc:0.0.1600.1200,ac:436.6945.728.90,am:i,cc:436.6945.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B373~0%5D,as:%5B373~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n.877959-58497149%7C1n1%7C1o.877959-58497149%7C1o1%7C1p.877959-58497151%7C1p1%7C1q.877959-58497147%7C1q1%7C1r*.877959-58497149%7C1s,idMap:1r*,rmeas:1,rend:0,renddet:IMG.us,slid:%5Bgoogle_ads_iframe_/15184186/bleepingcomputer_728x90_970x90_970x250_320x50_BTF_0,google_ads_iframe_/15184186/bleepingcomputer_728x90_970x90_970x250_320x50_BTF_0__container__,bleepingcomputer_728x90_970x90_970x250_320x50_BTF%5D,sinceFw:336,readyFired:true%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
x-server-name
dt03.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
impl_v81.js
www.googletagservices.com/dcm/ Frame 4248 		41 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v81.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 08:03:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
150087
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17189
x-xss-protection
0
last-modified
Mon, 18 Oct 2021 20:08:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 08:03:15 GMT
impl_v81.js
www.googletagservices.com/dcm/ Frame ADE7 		41 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v81.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 08:03:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
150087
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17189
x-xss-protection
0
last-modified
Mon, 18 Oct 2021 20:08:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 08:03:15 GMT
B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3492570197;ord=2a5py5;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D429d09db-0535-48f...
ad.doubleclick.net/ddm/adj/N144601.286450AMNET/ Frame F0A3 		42 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3492570197;ord=2a5py5;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D429d09db-0535-48fb-aeef-449b1f06712e%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DcpHj7vraFx5YWE_EXdhTKtB6cOC66IJg76CxZm9gGcI.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=109;prcl=s
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.81.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s74-in-f6.1e100.net
Software
cafe /
Resource Hash
3645c15aa6e70a1557f8d3520402e0cfc620251a090adda789de9e3e7ea6c551
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20984
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
B26798917.320123305;dc_ver=81.236;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=1601075548;ord=gfdeti;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D944e8539-133d-4ade-8716-db20c6149...
ad.doubleclick.net/ddm/adj/N144601.286450AMNET/ Frame 5491 		42 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=1601075548;ord=gfdeti;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D944e8539-133d-4ade-8716-db20c61496c3%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DA_60XKNU9FyhvExmfc84nFoc-OMFgxwnwJdvBgoFT-c.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_320x50_InContent_1%2Fbleepingcomputer_728x90_320x50_InContent_1%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=99;prcl=s
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.81.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s74-in-f6.1e100.net
Software
cafe /
Resource Hash
89dcb924c8b66ef3591aa604353080212725871497ed027878db0743a76edc87
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21062
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
B26798917.320123311;dc_ver=81.236;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;nel=1;dc_adk=2728075850;ord=bkmt7m;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D9090efe1-fb9c-44...
ad.doubleclick.net/ddm/adj/N144601.286450AMNET/ Frame 08B5 		42 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123311;dc_ver=81.236;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;nel=1;dc_adk=2728075850;ord=bkmt7m;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D9090efe1-fb9c-442d-803b-1d7ac113fa60%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DkvI8Wud95h7zeh0LKc1MLDG_Mcpup3-fweibDHVG94k.%26crid%3Doybxzi69%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_300x250_300x600_160x600_Right_2%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=156;prcl=s
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.81.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s74-in-f6.1e100.net
Software
cafe /
Resource Hash
78cf8a7dbbe74dbef3f36a214ad0ce6f50a430b2d18eac029076c2dcd7355d9f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21000
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
B26798917.320123302;dc_ver=81.236;dc_eid=40004001;sz=300x600;u_sd=1;gdpr=0;nel=1;dc_adk=2682109653;ord=up9pis;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Da6bb0b9f-340b-4b...
ad.doubleclick.net/ddm/adj/N144601.286450AMNET/ Frame 4248 		41 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123302;dc_ver=81.236;dc_eid=40004001;sz=300x600;u_sd=1;gdpr=0;nel=1;dc_adk=2682109653;ord=up9pis;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Da6bb0b9f-340b-4bd4-b92a-1fc651fcbf46%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DSFcAtgCvs6oXQjMfVUyTkL0llbazjCTL1iXwOgbOYrQ.%26crid%3D8334xbua%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_300x250_300x600_160x600_Right_3%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=162;prcl=s
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.81.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s74-in-f6.1e100.net
Software
cafe /
Resource Hash
cd8d822ef14852f2b0b8b6dc4090c56318c02ea89e01d5b639843bc1ff1b1f5c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20875
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3656561802;ord=1dyeb6;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Dcb4f6517-8ebb-4b3...
ad.doubleclick.net/ddm/adj/N144601.286450AMNET/ Frame ADE7 		42 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3656561802;ord=1dyeb6;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Dcb4f6517-8ebb-4b3f-9a53-8d7653aefd9e%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DVSqHg-He5LQjoOfQ1keUYzvdmJSnMkGrvMy3_9v2eXY.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=158;prcl=s
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.81.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s74-in-f6.1e100.net
Software
cafe /
Resource Hash
e54c1167baa64850d460c27373205e6b3a36986cc12bacc531f0501ff6b7f90e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21051
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 66BE
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIDNgzRxRAllHvkHcYSuh4U&google_cver=1&google_push=AYg5qPIPpJTBoIS3_n2kdpLSjSg8bm8xyt1ij9a5athl08J9ZPAgqhQ4jL...
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPIPpJTBoIS3_n2kdpLSjSg8bm8xyt1ij9a5athl08J9ZPAgqhQ4jLbGplFkq_PrMCMdBLGrJxp1OT6VCzM46e-F70JN5Iis&google_hm=O0YxuS...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPIPpJTBoIS3_n2kdpLSjSg8bm8xyt1ij9a5athl08J9ZPAgqhQ4jLbGplFkq_PrMCMdBLGrJxp1OT6VCzM46e-F70JN5Iis&google_hm=O0YxuSrWVjeIf42R3egWfw
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPIPpJTBoIS3_n2kdpLSjSg8bm8xyt1ij9a5athl08J9ZPAgqhQ4jLbGplFkq_PrMCMdBLGrJxp1OT6VCzM46e-F70JN5Iis&google_hm=O0YxuSrWVjeIf42R3egWfw
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 66BE
Redirect Chain
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLDuwKa...
  • https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTQ0MzYwMzIwMDg0MzEzMTM0OQ%3D%3D&google_push=AYg5qPLDuwKay2Wd2qh1O_hFsRlUEZjcHH7-fKoVbbFoXvRXwNQjrBx1NLiI_lfrNzj75L...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTQ0MzYwMzIwMDg0MzEzMTM0OQ%3D%3D&google_push=AYg5qPLDuwKay2Wd2qh1O_hFsRlUEZjcHH7-fKoVbbFoXvRXwNQjrBx1NLiI_lfrNzj75LvnBaXzcAeBt0MM4CrHmZqSO4LomOMO
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTQ0MzYwMzIwMDg0MzEzMTM0OQ%3D%3D&google_push=AYg5qPLDuwKay2Wd2qh1O_hFsRlUEZjcHH7-fKoVbbFoXvRXwNQjrBx1NLiI_lfrNzj75LvnBaXzcAeBt0MM4CrHmZqSO4LomOMO
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
max-age=0, no-cache, no-store
content-length
0
strict-transport-security
max-age=2628000
expires
Sun, 05 Dec 2021 01:44:42 GMT
pixel
cm.g.doubleclick.net/ Frame 66BE
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESECWpq2fTZ8n-Vc3IO6jRaDs&google_cver=1&google_push=AYg5qPJCf9Oat_JnI4u9eDy1K_J4OR8C0ghY1bdjQljYnw3gAbF-bcv5yL9064KkQUbiDg88sK4GZ4vfh4r7GIQHIrRl4i9yFzT8
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJCf9Oat_JnI4u9eDy1K_J4OR8C0ghY1bdjQljYnw3gAbF-bcv5yL9064KkQUbiDg88sK4GZ4vfh4r7GIQHIrRl4i9yFzT8&google_hm=lSkhB-hZjQCaEaIok53ZdA==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJCf9Oat_JnI4u9eDy1K_J4OR8C0ghY1bdjQljYnw3gAbF-bcv5yL9064KkQUbiDg88sK4GZ4vfh4r7GIQHIrRl4i9yFzT8&google_hm=lSkhB-hZjQCaEaIok53ZdA==
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:41 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJCf9Oat_JnI4u9eDy1K_J4OR8C0ghY1bdjQljYnw3gAbF-bcv5yL9064KkQUbiDg88sK4GZ4vfh4r7GIQHIrRl4i9yFzT8&google_hm=lSkhB-hZjQCaEaIok53ZdA==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-request-id
scffga815ukm1156072b4tffgbrl3mcc
pixel
cm.g.doubleclick.net/ Frame 66BE
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9Fi8GNwNSPmYzGFdV6LDlg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9Fi8GNwNSPmYzGFdV6LDlg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJjQUJASA0yzm-MnSBeGpbUOhJp6S_WDiAZiCKfA4uDUzE_fQwXAKejwbfvTQKZGndKJa4uzHL1bhtM6hyHnTd_vE2zQxxd
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=9Fi8GNwNSPmYzGFdV6LDlg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJjQUJASA0yzm-MnSBeGpbUOhJp6S_WDiAZiCKfA4uDUzE_fQwXAKejwbfvTQKZGndKJa4uzHL1bhtM6hyHnTd_vE2zQxxd
date
Sun, 05 Dec 2021 01:44:42 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 66BE
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEA08bjXZLwQ8ILpk_YBAPnc&google_cver=1&google_push=AYg5qPLAU2o-0TA1z2K_uAu9c5jWnVAplaUT1KWACBJk0tC8pn8vjS6xNvSepCeJAN7fEts1_1D...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH&google_push=AYg5qPLAU2o-0TA1z2K_uAu9c5jWnVAplaUT1KWACBJk0tC8pn8vjS6xNvSepCeJAN7fEts1_1DRzxsxHduE4Ff2tZ_aj-uEPEo
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH&google_push=AYg5qPLAU2o-0TA1z2K_uAu9c5jWnVAplaUT1KWACBJk0tC8pn8vjS6xNvSepCeJAN7fEts1_1DRzxsxHduE4Ff2tZ_aj-uEPEo
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDBSRTgtMy1JTEpH&google_push=AYg5qPLAU2o-0TA1z2K_uAu9c5jWnVAplaUT1KWACBJk0tC8pn8vjS6xNvSepCeJAN7fEts1_1DRzxsxHduE4Ff2tZ_aj-uEPEo
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
d3682eda7e5cb79782b1d5475f50e8fc
Expires
0
pixel
cm.g.doubleclick.net/ Frame 66BE
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhj...
0
0
pixel
cm.g.doubleclick.net/ Frame 66BE
Redirect Chain
  • https://cc.adingo.jp/adx/push/?google_gid=CAESELiRqzMTcmWEQdygDz_4UO4&google_cver=1&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b...
0
0
attr
cm.g.doubleclick.net/pixel/ Frame 66BE 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I7QUiKBEjHJ2z7hFqhBhW1iFLGoXBoGwmahxEdQjRhigdGo4OnWb9-gHbuYtJyl6oC00hw
Requested by
Host: 83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
URL: https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
pixel.gif
beacon.krxd.net/ 		0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/pixel.gif?source=smarttag&fired=report&confid=womptv2nm&_kpid=9427dd0d-835c-471c-a5db-ab01ae8a681c&_kcp_s=Freestar&_kcp_d=www.bleepingcomputer.com&_knifr=27&_kua_kx_tz=0&geo_country=ca&geo_region=qc&geo_dma=124462&_kua_kx_lang=en-us&_kua_kx_tech_browser_language=en-us&_kua_kx_tech_browser=Chrome%209&_kua_kx_tech_manufacturer=Microsoft%20Corporation&_kua_kx_tech_device=Computer&_kua_kx_tech_os=Windows%2010&_kua_kx_geo_country=ca&_kua_kx_geo_region=qc&_kua_kx_geo_dma=124462&_kpa_url_path_1=news&_kpa_url_path_2=security&_kpa_url_path_3=emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot&_kpa_domain=www.bleepingcomputer.com&t_navigation_type=0&t_dns=12&t_tcp=33&t_http_request=-1&t_http_response=20&t_content_ready=601&t_window_load=0&t_redirect=0&interchange_ran=false&userdata_was_requested=true&userdata_did_respond=true&store_user_after=wxabijvbr&userdata_user=OhYp_D7F%2Cwxabijvbr&sview=1&kplt0=39860&kplt1=47346&jsonp_requests=https%3A%2F%2Fconsumer.krxd.net%2Fconsent%2Fget%2F9427dd0d-835c-471c-a5db-ab01ae8a681c%2C349%2Chttps%3A%2F%2Fbeacon.krxd.net%2Foptout_check%2C264%2Chttps%3A%2F%2Fcdn.krxd.net%2Fuserdata%2Fget%2C374
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.47.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-47-24.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private, no-cache, no-store
x-request-time
D=45 t=1638668682
x-served-by
beacon-n017-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 5491 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:35:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
537
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:35:45 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 5491 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv4e55fSmXznRZN-GlS27Lv7yQYXn52E3hbqDf4jMpAa73DmqAQulmtxG1dkZ8FQHeb9MR-EP6D-8d1plYhQhz7VtJws9d-kIAH8Gev3r7bm-dKw6bIiBBLYSn4pt61i_vKORVU0Gw9d7Zh8Kez-0XHV79hVQVhTyNI&sig=Cg0ArKJSzJYqt5uE3PrMEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.87375&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=1601075548;ord=gfdeti;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D944e8539-133d-4ade-8716-db20c61496c3%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DA_60XKNU9FyhvExmfc84nFoc-OMFgxwnwJdvBgoFT-c.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_320x50_InContent_1%2Fbleepingcomputer_728x90_320x50_InContent_1%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=99;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 5491 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77571
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
MC_AM_IDEON_728x90_en.png
s0.2mdn.net/8497077/ Frame 5491 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/8497077/MC_AM_IDEON_728x90_en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
50cc2ba64721a6489beb02e7470f1d753cf0b02c4868f47e5ef8a975ec7fa1d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 12:25:25 GMT
x-content-type-options
nosniff
age
47957
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32101
x-xss-protection
0
last-modified
Wed, 10 Nov 2021 22:41:10 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 12:25:25 GMT
n.js
geo.moatads.com/ 		112 B
287 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=TRADEDESKV3&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&cm=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1638668682370&de=446533987442&m=0&ar=553ffc12ef5-clean&iw=5f11175&q=2&cb=0&ym=0&cu=1638668682370&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&zMoatJS=-&zMoatCachebuster=830023&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatDomain=bleepingcomputer.com&zMoatImpressionId=944e8539-133d-4ade-8716-db20c61496c3&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD05NDRlODUzOS0xMzNkLTRhZGUtODcxNi1kYjIwYzYxNDk2YzMmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02Njc3MDgzNzgwMTQxMjc3MzMzJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfMzIweDUwX0luQ29udGVudF8xL2JsZWVwaW5nY29tcHV0ZXJfNzI4eDkwXzMyMHg1MF9JbkNvbnRlbnRfMSZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&bd=www.bleepingcomputer.com&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&gw=thetradedeskv275874568748&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A512%3A512%3A0%3A602&jk=-1&jm=-1&fs=195402&na=674262897&cs=0&ord=1638668682370&jv=2023173080&callback=DOMlessLLDcallback_95253967
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/thetradedeskv275874568748/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.134.2.65 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-134-2-65.us-east-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
741106ff7bb4c2b7d2ddfa50b0cb4b7ca451b0dc0cd4ee93e965d3b537fe1150

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
max-age=900
server
TornadoServer/4.5.3
timing-allow-origin
*
etag
"a253df7206fb35cf7b02fc10c90a18fba2e45798"
content-length
112
content-type
text/html; charset=UTF-8
v2
mb.moatads.com/s/ 		234 B
410 B 		Script
General
Check archive.org
Download Go to
Full URL
https://mb.moatads.com/s/v2?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&pcode=thetradedeskv275874568748&ord=1638668682370&jv=1230015792&callback=BrandSafetyNadoscallback_95253967
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/thetradedeskv275874568748/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.134.2.65 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-134-2-65.us-east-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
86bad3f0676ec6ada12bc991b7004d764e9d39b1c489ae7be7e0422c66d5a398

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
max-age=900
server
TornadoServer/4.5.3
timing-allow-origin
*
etag
"43e47f6d8d8a8456c9d17e20f39871881d35bd95"
content-length
234
content-type
text/html; charset=UTF-8
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=TRADEDESKV3&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&cm=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1638668682370&de=446533987442&m=0&ar=553ffc12ef5-clean&iw=5f11175&q=3&cb=0&ym=0&cu=1638668682370&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&zMoatJS=-&zMoatCachebuster=830023&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatDomain=bleepingcomputer.com&zMoatImpressionId=944e8539-133d-4ade-8716-db20c61496c3&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD05NDRlODUzOS0xMzNkLTRhZGUtODcxNi1kYjIwYzYxNDk2YzMmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02Njc3MDgzNzgwMTQxMjc3MzMzJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfMzIweDUwX0luQ29udGVudF8xL2JsZWVwaW5nY29tcHV0ZXJfNzI4eDkwXzMyMHg1MF9JbkNvbnRlbnRfMSZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&bd=www.bleepingcomputer.com&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&gw=thetradedeskv275874568748&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A512%3A512%3A0%3A602&jk=-1&jm=-1&fs=195402&na=953925649&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:42 GMT
/
insight.adsrvr.org/enduser/pie/ 		807 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/pie/?pie=20&vet=0&rtb=dD0xJmlpZD05NDRlODUzOS0xMzNkLTRhZGUtODcxNi1kYjIwYzYxNDk2YzMmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02Njc3MDgzNzgwMTQxMjc3MzMzJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfMzIweDUwX0luQ29udGVudF8xL2JsZWVwaW5nY29tcHV0ZXJfNzI4eDkwXzMyMHg1MF9JbkNvbnRlbnRfMSZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
async_usersync.html
acdn.adnxs.com/dmp/ Frame F92B 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:44 GMT
Date
Sun, 05 Dec 2021 01:44:42 GMT
Connection
keep-alive
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame 5491 		0
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKePPBMHh4AAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9FMBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC_yAr8GCgtfX1RURF9DTEtfXxKvBiZpbXA9NDI5ZDA5ZGItMDUzNS00OGZiLWFlZWYtNDQ5YjFmMDY3MTJlJmFnPXZwamt2c20mc2ZlPTEzZTM5OTg1JnNpZz1jcEhqN3ZyYUZ4NVlXRV9FWGRoVEt0QjZjT0M2NklKZzc2Q3habTlnR2NJLiZjcmlkPWx3MnEydDd5JmNmPTI3MTYzMjkmZnE9MCZ0PTEmdGRfcz13d3cuYmxlZXBpbjITAfTTASZyY2F0cz0yZHgsb2JrLGpiYSx5dmIsM2dzJm1jYXQ9Jm1zdGU9Jm1mbGQ9NCZtc3NpPSZtZnNpPSZzdj1hcHBuZXh1cyZ1aG93PTE2NCZhZ3NhPSZ3cD0ke1BSSUNFX1BBSUR9JnJnej1IM0ImZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZzdnBpZD03MTI1JnJsYW5ncz1lbiZtbGFuZz0mZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZ0bXBjPS03LjI1JnZydGQ9Jm9zaT0mb3N2PSZkYWlkPSZkbnI9MCZ2cGI9JmM9Q2daRFlXNWhaR0VTQmxGMVpXSmxZeG9BSWdoTmIyNTBjbVZoYkRnQ1VBRllBb0FCQUlnQkFaQUJBQS4uJmR1cj1Da2dLSVdOb1lYSm5aUzFoYkd4TmIyRjBWbWxsZDJGaWFXeHBkSGxVY21GamEybHVaeUlqQ0tYX19fX19fX19fX3dFU0RtMXZZWFF0Y21Wd2IzSjBhVzVuS2dZSXdJUTlHQXcuJmR1cnM9eTZWRU13JmNycmVscj0mbnB0PSZtaz1Hb29nbGUmbWRsPUNocm9tZSUyMC0lMjBXaSlaOGFkcHQ9YW5vciZpcGw9YjoPAyhfNzI4eDkwXzk3MBEHODI1MF8zMjB4NTBfQVRGL8IyAEwmcGNtPTEmaWN0PVVua25vd24mcyF5ZDc0ODA0NzQ0MzEwNDUyMjAwNDImYXVjdD0xaUMMJSVUVGVDGCUlEq8GJmn-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwO6QwPIFQoRT1ZFUlJJREVfTUVUQURBVEESAPICDwoLTklFTFNFTl9UQUcSAPICDQoJTFVDSURfGRAUSVNQT1RfDRAMgQEKDmGLMFBJWEVMX0hFQUQSb2jtU3xueTEtYmlkLmFkc3J2ci5vcmcvYmlkL2ZlZWRiYWNrL9ELBD90gQMUaWQ9NDI5hgYHIGNyaWQ9bHcyccW9GHdwPfICnQcuhQAcVEFJTBKKByaFSPBYMTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZ0ZGlkPSZwaWQ9M2k4amI4aiZhZz12cGrlh_BpYWR2PW00Y3BuZGgmc2lnPTF3dG9YUDluemhac2dONHBtdi1JcXNZcVk4RWtOQURaWkJaQ1lIWFpKc3ZNLiZicD0yLjMzNDg1NzQ3NjQwODIxJmNmPTI3MTYzMjkmZnE9MCZ0ZF9zPXd3d1KcCOaJBwB1Nn0H8Wwgc3ZidHRkPTEmonUHCHJsYTZqBwRzdiEsIDcxMjUmZGlkPUp1B3BsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJv2SAGQhwSQmdnA9MCZvc2k96ZeKxQb-qQf-qQfuqQcAYf6BB9qBBwx2Yz0zZnoHLp8HAGHlhvCLJmltPTEmbWM9YWQwMzhmYjctNjMxZi00N2ZmLTg2ZmYtMmFmZDU0NzBkOWFm8gKlEgoUVklFV0FCSUxJVFlfVFJBQ0tJTkcSjBI8bm9zY3JpcHQgY2xhc3M9Ik1PQVQtdGhldHJhZGVkZXNrdjI3NTg3NDU2ODc0OD9tb2F0Q2xpZW50TGV2ZWwxPW1tgAxhbXA7Oh0AIDI9YXcyd2xzN04dAAQzPXXGMjoAGFNsaWNlcjFmdQMBLzx6TW9hdEltcHJlc3Npb25JmrwEFTtEQ2FjaGVidXN0ZXI9MTI3MjU4GRwgUGFydG5lcklEmXIEbXAJciRWaWV3VHlwZT0wGS8cQ3JlYXRpdmW5FBUvFERlYWxJRHWEFRgwU3VwcGx5VmVuZG9yPbGGHR8IaXRliv8AGFB1Ymxpc2gFqmXwAWA6ggEgND0tIj48L25vKeQEPjwJCBQgc3JjPSLRKAR6LgE2JGFkcy5jb20vdGha-wEALwkmDC5qcyMBClIFAjoZAFkBOhkAOf0ZGYL5Adr1AQU3SvEBBRhG7QEFFz3pBRBG5QEFFzrhAQUUVt0BCRty2QEFI0LVATkgGExldmVsND0htjwlM0ElMkYlMkZpbnNpZ2h0_eM8JTJGZW5kdXNlciUyRnBpZQEoADMFCTAzRDIwJTI2dmV0JTNELg4E8HlFVkVOVF9UWVBFJTI2cnRiJTNEZEQweEptbHBaRDAwTWpsa01EbGtZaTB3TlRNMUxUUTRabUl0WVdWbFppMDBORGxpTVdZd05qY3hNbVVtWTNKcFpEMXNkekp4TW5RM2VTWjNjRDBrZTFCU1NVTkZYMUJCU1VSOUptRgFg8FgzTVRZM01EVTJORFl5TXpBNE1UZzNPRGt5Sm5kd1l6MVZVMFFtYzJabFBURXpaVE01T1RnMUpuQjFhV1E5T0RrNE56TXdOREU1TWpjM05UUTVOVEk1TnladwEg9GwETTJrNGFtSTRhaVpoWnoxMmNHcHJkbk50Sm1Ga2RqMXROR053Ym1Sb0ptSndQVEl1TXpNME9EVTNORGMyTkRBNE1qRW1ZMlk5TWpjeE5qTXlPU1ptY1Qwd0puUmtYM005ZDNkM0xtSnNaV1Z3YVc1blkyOXRjSFYwWlhJdVkyOXRKbkpqWVhSelBUSmtlQ3h2WW1zc2FtSmhMSGwyWWl3elozTW1iV05oZEQwbWJYTjBaVDBtYldac1pEMDBKbTF6YzJrOUptMW1jMms5Sm5Wb2IzYzlNVFkwSm1GbmMyRTlKbkpuZWoxSU0wSW1jM1ppZEhSa1BURW1aSFE5VUVNbWIzTm1QVmRwYm1SdmQzTW1iM005VjJsdVpHOTNjekV3Sm1KeVBVTm9jbTl0WlNaeWJHRnVaM005Wlc0bWJXeGhibWM5Sm5OMmNHbGtQVGN4TWpVbVpHbGtQVEV5TmpjMU9UUW1jbU40ZEQxUGRHaGxjaVpzWVhROU5EVXVORGs1TkRBd0pteHZiajB0TnpNdU5UY3dNekF3Sm5SdGNHTTlMVGN1TWpVbVpHRnBaRDBtZG5BOU1DWnZjMms5Sm05emRqMG1iV3M5UjI5dloyeGxKbTFrYkQxRGFISnZiV1VsTWpBdEpUSXdWMmx1Wkc5M2N5WmpQVU5uV2tSWlZ6Vm9Xa2RGVTBKc1JqRmFWMHBzV1hodlFVbG5hRTVpTWpVd1kyMVdhR0pFWjBOVlFVWlpRVzlCUWtGSlowSkJXa0ZDUVVFdUxpWmtkWEk5UTJ0blMwbFhUbTlaV0VwdVdsTXhhR0pIZUU1aU1rWXdWbTFzYkdReVJtbGhWM2h3WkVoc1ZXTnRSbXBoTW14MVdubEpha05MV0Y5ZlgxOWZYMTlmWDE5M1JWTkViVEYyV1ZoUmRHTnRWbmRpTTBvd1lWYzFia3RuV1VsM1NWRTVSMEYzTGlaamNuSmxiSEk5Sm1Ga2NIUTlZVzV2Y2lacGNHdzlZbXhsWlhCcGJtZGpiMjF3ZFhSbGNsODNNamg0T1RCZk9UY3dlRGt3WHprM01IZ3lOVEJmTXpJd2VEVXdYMEZVUmk5aWJHVmxjR2x1WjJOdmJYQjFkR1Z5WHpjeU9IZzVNRjg1TnpCNE9UQmZPVGN3ZURJMU1GOHpNakI0TlRCZlFWUkdKbkJqYlQweEpuWmpQVE1tYzJGcFpEMDNORGd3TkRjME5ETXhNRFExTWpJd01EUXlKbWxqZEQxVmJtdHViM2R1Sm1GMVkzUTlNU1pwYlQweEptMWpQV0ZrTURNNFptSTNMVFl6TVdZdE5EZG1aaTA0Tm1abUxUSmhabVExTkRjd1pEbGhaaVp6ZGoxaGNIQnVaWGgxY3cuLiIgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij48L3NjcmlwdD7yAhUKEVJFRkVSUkVSX1RSQUNLSU5HEgDyAhUKC0NBQ0hFQlVTVEVSEgY2OTgwNDHyAiAKBFNJVEUSGHd3dy4-fhHhTxzyAocBChZfXw6kDURTSVRFX1dJVEhfUEFUSF9fEm1e4hMsJTJmbmV3cyUyZnNlFvkUECUyZmVt6vsUHCUyZvICEAoMCYowVERJRF9fEgDyAhwKEQkTGFBBUlRORVIFGDAHM2k4amI4avICHQoVPh8APElOVF9fEgQyMDY18gIfChQJIBxBRFZFUlRJUxFCGpYNEPICIgoYSiIACUUYBjM0OTczMwFnABIJJRxDQU1QQUlHTgmHGj4KCPICITFDHSAJQxwHMTk4MzEzNB3KGEFER1JPVVAJQxpkCgFDDcoZHwlCLAgxMDExNDYxMfICHhWHGFJFQVRJVkUFRAAIHu0OAc0tyx0hDUYwMjEwOTQ3NTbyAhoKEAnNGEFERk9STUEhLwQGNxK7EwjyAiAxMTxTVVBQTFlWRU5ET1JfXxIIHgcKIQ0tMjIjAAlnEAE38gI8EUMgSU1QUkVTU0lPKS8AJI6_DwjyAhQRnxxDQVRFR09SWUkJABgR_BRERVZJQ0UODgggX18SAlBD8gIZMTsAThqcEAhQQ18lGgAAHU4JNxEXCCAKGykELmgIFFBST0ZJTAFXGAEw8gIWCgsJIwBMJSIABxqTDgjyAhhRpgxMT05HIRsenw4BigAPCTQQQ09VTlQFuxgGQ2FuYWRhITcAEzYcABBFTkNfXxkgCBgKDgkgFFJFR0lPTgEbFFF1ZWJlY0E7TX8NGw06ER8IEQoNCToQTUVUUk8pLwAWEYoUWklQQ09EAdUMA0gzQiH-DYcRGQlNCR0V2wBDDoYNKF8SCE1vbnRyZWFsAYRNNgUbCTUdHwQWCm2oGFRSVVNURVMlaSFHABkR1wxERUFMBRYABxr0DwzyAhsKTa8UTElNSVRfHvYNBF9fBToIIgodCdcx1yxJTkFQUF9PUFRfT1VBtQFfCCQKGQklJFBSSVZBVEVDT04BRwBUCWosamZzemQwM_ICKQoaHScEQ1ktSS0aOAt0cmFkZWRlc2swMfICJBGWaFVOSVhfVElNRVNUQU1QX18SCjE2Mzg2Njg2N2X0DZ9IRENPX01BUFBJTkdSVUxFX01BQzGGFeFJfhhPU0ZBTUlMQdIEATJBYi1TGExBTkdVQUchpQgCZW5hxw3VJFJFTkRFUklOR18B2ARFWAH2KAVPdGhlcvICIwofCdMsQ1VTVE9NQklEREVSNUQlAAQA8lkcDEdFTlIBYQAAIXdNAxhQVUJMSVNIrRQABA6lDUHErTMsR0RQUl9BUFBMSUVTLZMAH3E3BRwMQ09OUw6aCwRTVAWjpbAAGjE9MpYAADFuHQAAMm4dAAAzAR3wdYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA_vvGOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4zNy4xMjAuMjA1LjE4MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8AQSSxxUiAUBmAUAoAXK7d7uyfv-52fABQDJBQ6XHBwAAPA_0gUJCQkM8EkAANgFAeAFAeoFFwoNZnNfYWRfcHJvZHVjdBIGYmFubmVy8AWoA_oFBAgAEACQBgCYBgCiBg43MTI1I05ZTTI6NTI3ObgGAMEGAAVQLPA_0AbE0AHaBhYKEAURHQHwUhAAGADgBgHyBnIIiq9NEmxBaEVMOWswQUFBQURBQWtDQlFFSXhKam5CeERvaXJVQ0dKQ2FrQU1nQnlnQVFNNkpvUWRJNUpDaEIxQ0hMVmlmS1hFATwJARRIZ0FnUUUJDAEBZElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoH0f4EugchTEwAGAAgADAAOLIEQADIB7_NBdIHDS0bBElAAR4I2gcGAftMGADgBwDqBwIIAPAH2v8YiggCEAA.&s=8d6293d02aebd4fa8057dbc1dca4cb8aa3f907cb&bdref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:42 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
efe63847-0bcb-461e-8a83-0da42dc22a99
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
MC_AM_IDEON_728x90_en.png
s0.2mdn.net/8497077/ Frame F0A3 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/8497077/MC_AM_IDEON_728x90_en.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
50cc2ba64721a6489beb02e7470f1d753cf0b02c4868f47e5ef8a975ec7fa1d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 12:25:25 GMT
x-content-type-options
nosniff
age
47957
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32101
x-xss-protection
0
last-modified
Wed, 10 Nov 2021 22:41:10 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 12:25:25 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame F0A3 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:35:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
537
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:35:45 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame F0A3 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvsRcvs6hxL_5wZUhSP-g0MfGAe5cBzTjf3jZ4XGb07xgqAbXwyi_ByW9Gu66_-XTnojHvuG9EY-LHa0uTZijKW_-Fr4z2aMxCO14KOb4p0XN-5ybA63Qgh4ya9EjGE2MDd-D7o35k9zcgPDAIBxXO-KMXDhjenvLqa&sig=Cg0ArKJSzCgqJbRAe5a7EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.58979&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3492570197;ord=2a5py5;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D429d09db-0535-48fb-aeef-449b1f06712e%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DcpHj7vraFx5YWE_EXdhTKtB6cOC66IJg76CxZm9gGcI.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=109;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame F0A3 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77571
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
/
insight.adsrvr.org/enduser/pie/ 		807 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/pie/?pie=20&vet=0&rtb=dD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
/
insight.adsrvr.org/enduser/moat/ 		0
100 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/moat/?e=60&o=dD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
async_usersync.html
acdn.adnxs.com/dmp/ Frame 5C5E 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:44 GMT
Date
Sun, 05 Dec 2021 01:44:42 GMT
Connection
keep-alive
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame F0A3 		0
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKePPBMHh4AAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9FMBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC_yAr8GCgtfX1RURF9DTEtfXxKvBiZpbXA9NDI5ZDA5ZGItMDUzNS00OGZiLWFlZWYtNDQ5YjFmMDY3MTJlJmFnPXZwamt2c20mc2ZlPTEzZTM5OTg1JnNpZz1jcEhqN3ZyYUZ4NVlXRV9FWGRoVEt0QjZjT0M2NklKZzc2Q3habTlnR2NJLiZjcmlkPWx3MnEydDd5JmNmPTI3MTYzMjkmZnE9MCZ0PTEmdGRfcz13d3cuYmxlZXBpbjITAfTTASZyY2F0cz0yZHgsb2JrLGpiYSx5dmIsM2dzJm1jYXQ9Jm1zdGU9Jm1mbGQ9NCZtc3NpPSZtZnNpPSZzdj1hcHBuZXh1cyZ1aG93PTE2NCZhZ3NhPSZ3cD0ke1BSSUNFX1BBSUR9JnJnej1IM0ImZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZzdnBpZD03MTI1JnJsYW5ncz1lbiZtbGFuZz0mZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZ0bXBjPS03LjI1JnZydGQ9Jm9zaT0mb3N2PSZkYWlkPSZkbnI9MCZ2cGI9JmM9Q2daRFlXNWhaR0VTQmxGMVpXSmxZeG9BSWdoTmIyNTBjbVZoYkRnQ1VBRllBb0FCQUlnQkFaQUJBQS4uJmR1cj1Da2dLSVdOb1lYSm5aUzFoYkd4TmIyRjBWbWxsZDJGaWFXeHBkSGxVY21GamEybHVaeUlqQ0tYX19fX19fX19fX3dFU0RtMXZZWFF0Y21Wd2IzSjBhVzVuS2dZSXdJUTlHQXcuJmR1cnM9eTZWRU13JmNycmVscj0mbnB0PSZtaz1Hb29nbGUmbWRsPUNocm9tZSUyMC0lMjBXaSlaOGFkcHQ9YW5vciZpcGw9YjoPAyhfNzI4eDkwXzk3MBEHODI1MF8zMjB4NTBfQVRGL8IyAEwmcGNtPTEmaWN0PVVua25vd24mcyF5ZDc0ODA0NzQ0MzEwNDUyMjAwNDImYXVjdD0xaUMMJSVUVGVDGCUlEq8GJmn-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwO6QwPIFQoRT1ZFUlJJREVfTUVUQURBVEESAPICDwoLTklFTFNFTl9UQUcSAPICDQoJTFVDSURfGRAUSVNQT1RfDRAMgQEKDmGLMFBJWEVMX0hFQUQSb2jtU3xueTEtYmlkLmFkc3J2ci5vcmcvYmlkL2ZlZWRiYWNrL9ELBD90gQMUaWQ9NDI5hgYHIGNyaWQ9bHcyccW9GHdwPfICnQcuhQAcVEFJTBKKByaFSPBYMTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZ0ZGlkPSZwaWQ9M2k4amI4aiZhZz12cGrlh_BpYWR2PW00Y3BuZGgmc2lnPTF3dG9YUDluemhac2dONHBtdi1JcXNZcVk4RWtOQURaWkJaQ1lIWFpKc3ZNLiZicD0yLjMzNDg1NzQ3NjQwODIxJmNmPTI3MTYzMjkmZnE9MCZ0ZF9zPXd3d1KcCOaJBwB1Nn0H8Wwgc3ZidHRkPTEmonUHCHJsYTZqBwRzdiEsIDcxMjUmZGlkPUp1B3BsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJv2SAGQhwSQmdnA9MCZvc2k96ZeKxQb-qQf-qQfuqQcAYf6BB9qBBwx2Yz0zZnoHLp8HAGHlhvCLJmltPTEmbWM9YWQwMzhmYjctNjMxZi00N2ZmLTg2ZmYtMmFmZDU0NzBkOWFm8gKlEgoUVklFV0FCSUxJVFlfVFJBQ0tJTkcSjBI8bm9zY3JpcHQgY2xhc3M9Ik1PQVQtdGhldHJhZGVkZXNrdjI3NTg3NDU2ODc0OD9tb2F0Q2xpZW50TGV2ZWwxPW1tgAxhbXA7Oh0AIDI9YXcyd2xzN04dAAQzPXXGMjoAGFNsaWNlcjFmdQMBLzx6TW9hdEltcHJlc3Npb25JmrwEFTtEQ2FjaGVidXN0ZXI9MTI3MjU4GRwgUGFydG5lcklEmXIEbXAJciRWaWV3VHlwZT0wGS8cQ3JlYXRpdmW5FBUvFERlYWxJRHWEFRgwU3VwcGx5VmVuZG9yPbGGHR8IaXRliv8AGFB1Ymxpc2gFqmXwAWA6ggEgND0tIj48L25vKeQEPjwJCBQgc3JjPSLRKAR6LgE2JGFkcy5jb20vdGha-wEALwkmDC5qcyMBClIFAjoZAFkBOhkAOf0ZGYL5Adr1AQU3SvEBBRhG7QEFFz3pBRBG5QEFFzrhAQUUVt0BCRty2QEFI0LVATkgGExldmVsND0htjwlM0ElMkYlMkZpbnNpZ2h0_eM8JTJGZW5kdXNlciUyRnBpZQEoADMFCTAzRDIwJTI2dmV0JTNELg4E8HlFVkVOVF9UWVBFJTI2cnRiJTNEZEQweEptbHBaRDAwTWpsa01EbGtZaTB3TlRNMUxUUTRabUl0WVdWbFppMDBORGxpTVdZd05qY3hNbVVtWTNKcFpEMXNkekp4TW5RM2VTWjNjRDBrZTFCU1NVTkZYMUJCU1VSOUptRgFg8FgzTVRZM01EVTJORFl5TXpBNE1UZzNPRGt5Sm5kd1l6MVZVMFFtYzJabFBURXpaVE01T1RnMUpuQjFhV1E5T0RrNE56TXdOREU1TWpjM05UUTVOVEk1TnladwEg9GwETTJrNGFtSTRhaVpoWnoxMmNHcHJkbk50Sm1Ga2RqMXROR053Ym1Sb0ptSndQVEl1TXpNME9EVTNORGMyTkRBNE1qRW1ZMlk5TWpjeE5qTXlPU1ptY1Qwd0puUmtYM005ZDNkM0xtSnNaV1Z3YVc1blkyOXRjSFYwWlhJdVkyOXRKbkpqWVhSelBUSmtlQ3h2WW1zc2FtSmhMSGwyWWl3elozTW1iV05oZEQwbWJYTjBaVDBtYldac1pEMDBKbTF6YzJrOUptMW1jMms5Sm5Wb2IzYzlNVFkwSm1GbmMyRTlKbkpuZWoxSU0wSW1jM1ppZEhSa1BURW1aSFE5VUVNbWIzTm1QVmRwYm1SdmQzTW1iM005VjJsdVpHOTNjekV3Sm1KeVBVTm9jbTl0WlNaeWJHRnVaM005Wlc0bWJXeGhibWM5Sm5OMmNHbGtQVGN4TWpVbVpHbGtQVEV5TmpjMU9UUW1jbU40ZEQxUGRHaGxjaVpzWVhROU5EVXVORGs1TkRBd0pteHZiajB0TnpNdU5UY3dNekF3Sm5SdGNHTTlMVGN1TWpVbVpHRnBaRDBtZG5BOU1DWnZjMms5Sm05emRqMG1iV3M5UjI5dloyeGxKbTFrYkQxRGFISnZiV1VsTWpBdEpUSXdWMmx1Wkc5M2N5WmpQVU5uV2tSWlZ6Vm9Xa2RGVTBKc1JqRmFWMHBzV1hodlFVbG5hRTVpTWpVd1kyMVdhR0pFWjBOVlFVWlpRVzlCUWtGSlowSkJXa0ZDUVVFdUxpWmtkWEk5UTJ0blMwbFhUbTlaV0VwdVdsTXhhR0pIZUU1aU1rWXdWbTFzYkdReVJtbGhWM2h3WkVoc1ZXTnRSbXBoTW14MVdubEpha05MV0Y5ZlgxOWZYMTlmWDE5M1JWTkViVEYyV1ZoUmRHTnRWbmRpTTBvd1lWYzFia3RuV1VsM1NWRTVSMEYzTGlaamNuSmxiSEk5Sm1Ga2NIUTlZVzV2Y2lacGNHdzlZbXhsWlhCcGJtZGpiMjF3ZFhSbGNsODNNamg0T1RCZk9UY3dlRGt3WHprM01IZ3lOVEJmTXpJd2VEVXdYMEZVUmk5aWJHVmxjR2x1WjJOdmJYQjFkR1Z5WHpjeU9IZzVNRjg1TnpCNE9UQmZPVGN3ZURJMU1GOHpNakI0TlRCZlFWUkdKbkJqYlQweEpuWmpQVE1tYzJGcFpEMDNORGd3TkRjME5ETXhNRFExTWpJd01EUXlKbWxqZEQxVmJtdHViM2R1Sm1GMVkzUTlNU1pwYlQweEptMWpQV0ZrTURNNFptSTNMVFl6TVdZdE5EZG1aaTA0Tm1abUxUSmhabVExTkRjd1pEbGhaaVp6ZGoxaGNIQnVaWGgxY3cuLiIgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij48L3NjcmlwdD7yAhUKEVJFRkVSUkVSX1RSQUNLSU5HEgDyAhUKC0NBQ0hFQlVTVEVSEgY2OTgwNDHyAiAKBFNJVEUSGHd3dy4-fhHhTxzyAocBChZfXw6kDURTSVRFX1dJVEhfUEFUSF9fEm1e4hMsJTJmbmV3cyUyZnNlFvkUECUyZmVt6vsUHCUyZvICEAoMCYowVERJRF9fEgDyAhwKEQkTGFBBUlRORVIFGDAHM2k4amI4avICHQoVPh8APElOVF9fEgQyMDY18gIfChQJIBxBRFZFUlRJUxFCGpYNEPICIgoYSiIACUUYBjM0OTczMwFnABIJJRxDQU1QQUlHTgmHGj4KCPICITFDHSAJQxwHMTk4MzEzNB3KGEFER1JPVVAJQxpkCgFDDcoZHwlCLAgxMDExNDYxMfICHhWHGFJFQVRJVkUFRAAIHu0OAc0tyx0hDUYwMjEwOTQ3NTbyAhoKEAnNGEFERk9STUEhLwQGNxK7EwjyAiAxMTxTVVBQTFlWRU5ET1JfXxIIHgcKIQ0tMjIjAAlnEAE38gI8EUMgSU1QUkVTU0lPKS8AJI6_DwjyAhQRnxxDQVRFR09SWUkJABgR_BRERVZJQ0UODgggX18SAlBD8gIZMTsAThqcEAhQQ18lGgAAHU4JNxEXCCAKGykELmgIFFBST0ZJTAFXGAEw8gIWCgsJIwBMJSIABxqTDgjyAhhRpgxMT05HIRsenw4BigAPCTQQQ09VTlQFuxgGQ2FuYWRhITcAEzYcABBFTkNfXxkgCBgKDgkgFFJFR0lPTgEbFFF1ZWJlY0E7TX8NGw06ER8IEQoNCToQTUVUUk8pLwAWEYoUWklQQ09EAdUMA0gzQiH-DYcRGQlNCR0V2wBDDoYNKF8SCE1vbnRyZWFsAYRNNgUbCTUdHwQWCm2oGFRSVVNURVMlaSFHABkR1wxERUFMBRYABxr0DwzyAhsKTa8UTElNSVRfHvYNBF9fBToIIgodCdcx1yxJTkFQUF9PUFRfT1VBtQFfCCQKGQklJFBSSVZBVEVDT04BRwBUCWosamZzemQwM_ICKQoaHScEQ1ktSS0aOAt0cmFkZWRlc2swMfICJBGWaFVOSVhfVElNRVNUQU1QX18SCjE2Mzg2Njg2N2X0DZ9IRENPX01BUFBJTkdSVUxFX01BQzGGFeFJfhhPU0ZBTUlMQdIEATJBYi1TGExBTkdVQUchpQgCZW5hxw3VJFJFTkRFUklOR18B2ARFWAH2KAVPdGhlcvICIwofCdMsQ1VTVE9NQklEREVSNUQlAAQA8lkcDEdFTlIBYQAAIXdNAxhQVUJMSVNIrRQABA6lDUHErTMsR0RQUl9BUFBMSUVTLZMAH3E3BRwMQ09OUw6aCwRTVAWjpbAAGjE9MpYAADFuHQAAMm4dAAAzAR3wdYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA_vvGOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4zNy4xMjAuMjA1LjE4MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8AQSSxxUiAUBmAUAoAXK7d7uyfv-52fABQDJBQ6XHBwAAPA_0gUJCQkM8EkAANgFAeAFAeoFFwoNZnNfYWRfcHJvZHVjdBIGYmFubmVy8AWoA_oFBAgAEACQBgCYBgCiBg43MTI1I05ZTTI6NTI3ObgGAMEGAAVQLPA_0AbE0AHaBhYKEAURHQHwUhAAGADgBgHyBnIIiq9NEmxBaEVMOWswQUFBQURBQWtDQlFFSXhKam5CeERvaXJVQ0dKQ2FrQU1nQnlnQVFNNkpvUWRJNUpDaEIxQ0hMVmlmS1hFATwJARRIZ0FnUUUJDAEBZElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoH0f4EugchTEwAGAAgADAAOLIEQADIB7_NBdIHDS0bBElAAR4I2gcGAftMGADgBwDqBwIIAPAH2v8YiggCEAA.&s=8d6293d02aebd4fa8057dbc1dca4cb8aa3f907cb&bdref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:42 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
069a8041-acb3-4782-949b-d4ad7b7a28f4
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9ef1eab2-63bf-ab8a-ec9f-720656398207&tv=%7Bc:vSM0L1,pingTime:-10,time:1289,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuNDUgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000020000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1638668682595%7C%7C8a666fe60c44d090fb009b78565b223c%7C%7Cb4088f046bf9a570f2964ffc86d258ff%7C%7Ce6a68714d192b613b4f5f8d28e96f81b%7C%7C78a63098db532ca2343bc8fffe809565%7C%7C98412207097f34991e50fbb62197161b%7C%7Cd20797966432dba3574fcefea33235bd%7C%7C54abd9123040dcb985671a8f61cb9ea9%7C%7C1629390669,im:%7Bimprf:%7Bttecl:1587,ecd:28,tsecr:422%7D%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:42 GMT
x-server-name
dt09.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
514171
vid.springserve.com/vast/ Frame A266 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
ac46b748a106dddd4f60471290a1994db96aa6f1a53aae424a8fd841efff8bfb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-encoding
gzip
content-type
application/xml;charset=UTF-8
index.html
storage.googleapis.com/session-hub/ Frame BB02 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/session-hub/index.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2010 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
b73857582989f2602487dc4de28f9e84ec0f34dad3857a405137e60150e4bfa4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/

Response headers

x-guploader-uploadid
ADPycdvKF-FpJxN7NYkXKtQzkfFJQhPCaDR6SJZ82WJGMG7s-81Gvky4McnNpU39cGiO0vutdpZhCcxRP1Fc_y2FUnVny52LoQ
expires
Sun, 05 Dec 2021 01:57:39 GMT
date
Sun, 05 Dec 2021 00:57:39 GMT
last-modified
Wed, 28 Aug 2019 19:06:32 GMT
etag
"81bfe4f005f3280a68f6b07b2b1c8d60"
x-goog-generation
1567019192557207
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
2151
content-type
text/html
content-language
en
x-goog-hash
crc32c=R+UPRg== md5=gb/k8AXzKApo9rB7KxyNYA==
x-goog-storage-class
REGIONAL
accept-ranges
bytes
content-length
2151
server
UploadServer
age
2823
cache-control
public, max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 08B5 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:35:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
537
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:35:45 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 08B5 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvLk3wEUt21TDa8zCYxTJvNPSlT6WwFEbUSAgZzLzop8kSL-ZCXE-vNMB6MGAz5G82WB8GxkF48shPxUakoDZO44WIp62vpqi1c7UajWl0LFyPC5TZz22XFmRrsdS5zBOfrStOcN-b5bx8ZtU2BGqyRJwMHctevRAmF&sig=Cg0ArKJSzFVCyrM0CC-8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.38737&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123311;dc_ver=81.236;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;nel=1;dc_adk=2728075850;ord=bkmt7m;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D9090efe1-fb9c-442d-803b-1d7ac113fa60%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DkvI8Wud95h7zeh0LKc1MLDG_Mcpup3-fweibDHVG94k.%26crid%3Doybxzi69%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_300x250_300x600_160x600_Right_2%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=156;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 08B5 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77571
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
MC_AM_IDEON_300x250_en.png
s0.2mdn.net/8497077/ Frame 08B5 		56 KB
56 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/8497077/MC_AM_IDEON_300x250_en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2e774ee383518a9662cd4215456c8e96bf45cfb05bd2ab57a390191aa1f86ae9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 20:20:31 GMT
x-content-type-options
nosniff
age
19451
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
57470
x-xss-protection
0
last-modified
Wed, 10 Nov 2021 22:41:02 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 20:20:31 GMT
/
insight.adsrvr.org/enduser/pie/ 		807 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/pie/?pie=20&vet=0&rtb=dD0xJmlpZD05MDkwZWZlMS1mYjljLTQ0MmQtODAzYi0xZDdhYzExM2ZhNjAmY3JpZD1veWJ4emk2OSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD0zMjMyNDg5NTM4MDg3MDkxMzA0JndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8yL2JsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMiZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
async_usersync.html
acdn.adnxs.com/dmp/ Frame 034B 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:44 GMT
Date
Sun, 05 Dec 2021 01:44:42 GMT
Connection
keep-alive
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame 08B5 		0
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKePPBMHh4AAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9FMBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC_yAr8GCgtfX1RURF9DTEtfXxKvBiZpbXA9NDI5ZDA5ZGItMDUzNS00OGZiLWFlZWYtNDQ5YjFmMDY3MTJlJmFnPXZwamt2c20mc2ZlPTEzZTM5OTg1JnNpZz1jcEhqN3ZyYUZ4NVlXRV9FWGRoVEt0QjZjT0M2NklKZzc2Q3habTlnR2NJLiZjcmlkPWx3MnEydDd5JmNmPTI3MTYzMjkmZnE9MCZ0PTEmdGRfcz13d3cuYmxlZXBpbjITAfTTASZyY2F0cz0yZHgsb2JrLGpiYSx5dmIsM2dzJm1jYXQ9Jm1zdGU9Jm1mbGQ9NCZtc3NpPSZtZnNpPSZzdj1hcHBuZXh1cyZ1aG93PTE2NCZhZ3NhPSZ3cD0ke1BSSUNFX1BBSUR9JnJnej1IM0ImZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZzdnBpZD03MTI1JnJsYW5ncz1lbiZtbGFuZz0mZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZ0bXBjPS03LjI1JnZydGQ9Jm9zaT0mb3N2PSZkYWlkPSZkbnI9MCZ2cGI9JmM9Q2daRFlXNWhaR0VTQmxGMVpXSmxZeG9BSWdoTmIyNTBjbVZoYkRnQ1VBRllBb0FCQUlnQkFaQUJBQS4uJmR1cj1Da2dLSVdOb1lYSm5aUzFoYkd4TmIyRjBWbWxsZDJGaWFXeHBkSGxVY21GamEybHVaeUlqQ0tYX19fX19fX19fX3dFU0RtMXZZWFF0Y21Wd2IzSjBhVzVuS2dZSXdJUTlHQXcuJmR1cnM9eTZWRU13JmNycmVscj0mbnB0PSZtaz1Hb29nbGUmbWRsPUNocm9tZSUyMC0lMjBXaSlaOGFkcHQ9YW5vciZpcGw9YjoPAyhfNzI4eDkwXzk3MBEHODI1MF8zMjB4NTBfQVRGL8IyAEwmcGNtPTEmaWN0PVVua25vd24mcyF5ZDc0ODA0NzQ0MzEwNDUyMjAwNDImYXVjdD0xaUMMJSVUVGVDGCUlEq8GJmn-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwO6QwPIFQoRT1ZFUlJJREVfTUVUQURBVEESAPICDwoLTklFTFNFTl9UQUcSAPICDQoJTFVDSURfGRAUSVNQT1RfDRAMgQEKDmGLMFBJWEVMX0hFQUQSb2jtU3xueTEtYmlkLmFkc3J2ci5vcmcvYmlkL2ZlZWRiYWNrL9ELBD90gQMUaWQ9NDI5hgYHIGNyaWQ9bHcyccW9GHdwPfICnQcuhQAcVEFJTBKKByaFSPBYMTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZ0ZGlkPSZwaWQ9M2k4amI4aiZhZz12cGrlh_BpYWR2PW00Y3BuZGgmc2lnPTF3dG9YUDluemhac2dONHBtdi1JcXNZcVk4RWtOQURaWkJaQ1lIWFpKc3ZNLiZicD0yLjMzNDg1NzQ3NjQwODIxJmNmPTI3MTYzMjkmZnE9MCZ0ZF9zPXd3d1KcCOaJBwB1Nn0H8Wwgc3ZidHRkPTEmonUHCHJsYTZqBwRzdiEsIDcxMjUmZGlkPUp1B3BsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJv2SAGQhwSQmdnA9MCZvc2k96ZeKxQb-qQf-qQfuqQcAYf6BB9qBBwx2Yz0zZnoHLp8HAGHlhvCLJmltPTEmbWM9YWQwMzhmYjctNjMxZi00N2ZmLTg2ZmYtMmFmZDU0NzBkOWFm8gKlEgoUVklFV0FCSUxJVFlfVFJBQ0tJTkcSjBI8bm9zY3JpcHQgY2xhc3M9Ik1PQVQtdGhldHJhZGVkZXNrdjI3NTg3NDU2ODc0OD9tb2F0Q2xpZW50TGV2ZWwxPW1tgAxhbXA7Oh0AIDI9YXcyd2xzN04dAAQzPXXGMjoAGFNsaWNlcjFmdQMBLzx6TW9hdEltcHJlc3Npb25JmrwEFTtEQ2FjaGVidXN0ZXI9MTI3MjU4GRwgUGFydG5lcklEmXIEbXAJciRWaWV3VHlwZT0wGS8cQ3JlYXRpdmW5FBUvFERlYWxJRHWEFRgwU3VwcGx5VmVuZG9yPbGGHR8IaXRliv8AGFB1Ymxpc2gFqmXwAWA6ggEgND0tIj48L25vKeQEPjwJCBQgc3JjPSLRKAR6LgE2JGFkcy5jb20vdGha-wEALwkmDC5qcyMBClIFAjoZAFkBOhkAOf0ZGYL5Adr1AQU3SvEBBRhG7QEFFz3pBRBG5QEFFzrhAQUUVt0BCRty2QEFI0LVATkgGExldmVsND0htjwlM0ElMkYlMkZpbnNpZ2h0_eM8JTJGZW5kdXNlciUyRnBpZQEoADMFCTAzRDIwJTI2dmV0JTNELg4E8HlFVkVOVF9UWVBFJTI2cnRiJTNEZEQweEptbHBaRDAwTWpsa01EbGtZaTB3TlRNMUxUUTRabUl0WVdWbFppMDBORGxpTVdZd05qY3hNbVVtWTNKcFpEMXNkekp4TW5RM2VTWjNjRDBrZTFCU1NVTkZYMUJCU1VSOUptRgFg8FgzTVRZM01EVTJORFl5TXpBNE1UZzNPRGt5Sm5kd1l6MVZVMFFtYzJabFBURXpaVE01T1RnMUpuQjFhV1E5T0RrNE56TXdOREU1TWpjM05UUTVOVEk1TnladwEg9GwETTJrNGFtSTRhaVpoWnoxMmNHcHJkbk50Sm1Ga2RqMXROR053Ym1Sb0ptSndQVEl1TXpNME9EVTNORGMyTkRBNE1qRW1ZMlk5TWpjeE5qTXlPU1ptY1Qwd0puUmtYM005ZDNkM0xtSnNaV1Z3YVc1blkyOXRjSFYwWlhJdVkyOXRKbkpqWVhSelBUSmtlQ3h2WW1zc2FtSmhMSGwyWWl3elozTW1iV05oZEQwbWJYTjBaVDBtYldac1pEMDBKbTF6YzJrOUptMW1jMms5Sm5Wb2IzYzlNVFkwSm1GbmMyRTlKbkpuZWoxSU0wSW1jM1ppZEhSa1BURW1aSFE5VUVNbWIzTm1QVmRwYm1SdmQzTW1iM005VjJsdVpHOTNjekV3Sm1KeVBVTm9jbTl0WlNaeWJHRnVaM005Wlc0bWJXeGhibWM5Sm5OMmNHbGtQVGN4TWpVbVpHbGtQVEV5TmpjMU9UUW1jbU40ZEQxUGRHaGxjaVpzWVhROU5EVXVORGs1TkRBd0pteHZiajB0TnpNdU5UY3dNekF3Sm5SdGNHTTlMVGN1TWpVbVpHRnBaRDBtZG5BOU1DWnZjMms5Sm05emRqMG1iV3M5UjI5dloyeGxKbTFrYkQxRGFISnZiV1VsTWpBdEpUSXdWMmx1Wkc5M2N5WmpQVU5uV2tSWlZ6Vm9Xa2RGVTBKc1JqRmFWMHBzV1hodlFVbG5hRTVpTWpVd1kyMVdhR0pFWjBOVlFVWlpRVzlCUWtGSlowSkJXa0ZDUVVFdUxpWmtkWEk5UTJ0blMwbFhUbTlaV0VwdVdsTXhhR0pIZUU1aU1rWXdWbTFzYkdReVJtbGhWM2h3WkVoc1ZXTnRSbXBoTW14MVdubEpha05MV0Y5ZlgxOWZYMTlmWDE5M1JWTkViVEYyV1ZoUmRHTnRWbmRpTTBvd1lWYzFia3RuV1VsM1NWRTVSMEYzTGlaamNuSmxiSEk5Sm1Ga2NIUTlZVzV2Y2lacGNHdzlZbXhsWlhCcGJtZGpiMjF3ZFhSbGNsODNNamg0T1RCZk9UY3dlRGt3WHprM01IZ3lOVEJmTXpJd2VEVXdYMEZVUmk5aWJHVmxjR2x1WjJOdmJYQjFkR1Z5WHpjeU9IZzVNRjg1TnpCNE9UQmZPVGN3ZURJMU1GOHpNakI0TlRCZlFWUkdKbkJqYlQweEpuWmpQVE1tYzJGcFpEMDNORGd3TkRjME5ETXhNRFExTWpJd01EUXlKbWxqZEQxVmJtdHViM2R1Sm1GMVkzUTlNU1pwYlQweEptMWpQV0ZrTURNNFptSTNMVFl6TVdZdE5EZG1aaTA0Tm1abUxUSmhabVExTkRjd1pEbGhaaVp6ZGoxaGNIQnVaWGgxY3cuLiIgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij48L3NjcmlwdD7yAhUKEVJFRkVSUkVSX1RSQUNLSU5HEgDyAhUKC0NBQ0hFQlVTVEVSEgY2OTgwNDHyAiAKBFNJVEUSGHd3dy4-fhHhTxzyAocBChZfXw6kDURTSVRFX1dJVEhfUEFUSF9fEm1e4hMsJTJmbmV3cyUyZnNlFvkUECUyZmVt6vsUHCUyZvICEAoMCYowVERJRF9fEgDyAhwKEQkTGFBBUlRORVIFGDAHM2k4amI4avICHQoVPh8APElOVF9fEgQyMDY18gIfChQJIBxBRFZFUlRJUxFCGpYNEPICIgoYSiIACUUYBjM0OTczMwFnABIJJRxDQU1QQUlHTgmHGj4KCPICITFDHSAJQxwHMTk4MzEzNB3KGEFER1JPVVAJQxpkCgFDDcoZHwlCLAgxMDExNDYxMfICHhWHGFJFQVRJVkUFRAAIHu0OAc0tyx0hDUYwMjEwOTQ3NTbyAhoKEAnNGEFERk9STUEhLwQGNxK7EwjyAiAxMTxTVVBQTFlWRU5ET1JfXxIIHgcKIQ0tMjIjAAlnEAE38gI8EUMgSU1QUkVTU0lPKS8AJI6_DwjyAhQRnxxDQVRFR09SWUkJABgR_BRERVZJQ0UODgggX18SAlBD8gIZMTsAThqcEAhQQ18lGgAAHU4JNxEXCCAKGykELmgIFFBST0ZJTAFXGAEw8gIWCgsJIwBMJSIABxqTDgjyAhhRpgxMT05HIRsenw4BigAPCTQQQ09VTlQFuxgGQ2FuYWRhITcAEzYcABBFTkNfXxkgCBgKDgkgFFJFR0lPTgEbFFF1ZWJlY0E7TX8NGw06ER8IEQoNCToQTUVUUk8pLwAWEYoUWklQQ09EAdUMA0gzQiH-DYcRGQlNCR0V2wBDDoYNKF8SCE1vbnRyZWFsAYRNNgUbCTUdHwQWCm2oGFRSVVNURVMlaSFHABkR1wxERUFMBRYABxr0DwzyAhsKTa8UTElNSVRfHvYNBF9fBToIIgodCdcx1yxJTkFQUF9PUFRfT1VBtQFfCCQKGQklJFBSSVZBVEVDT04BRwBUCWosamZzemQwM_ICKQoaHScEQ1ktSS0aOAt0cmFkZWRlc2swMfICJBGWaFVOSVhfVElNRVNUQU1QX18SCjE2Mzg2Njg2N2X0DZ9IRENPX01BUFBJTkdSVUxFX01BQzGGFeFJfhhPU0ZBTUlMQdIEATJBYi1TGExBTkdVQUchpQgCZW5hxw3VJFJFTkRFUklOR18B2ARFWAH2KAVPdGhlcvICIwofCdMsQ1VTVE9NQklEREVSNUQlAAQA8lkcDEdFTlIBYQAAIXdNAxhQVUJMSVNIrRQABA6lDUHErTMsR0RQUl9BUFBMSUVTLZMAH3E3BRwMQ09OUw6aCwRTVAWjpbAAGjE9MpYAADFuHQAAMm4dAAAzAR3wdYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA_vvGOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4zNy4xMjAuMjA1LjE4MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8AQSSxxUiAUBmAUAoAXK7d7uyfv-52fABQDJBQ6XHBwAAPA_0gUJCQkM8EkAANgFAeAFAeoFFwoNZnNfYWRfcHJvZHVjdBIGYmFubmVy8AWoA_oFBAgAEACQBgCYBgCiBg43MTI1I05ZTTI6NTI3ObgGAMEGAAVQLPA_0AbE0AHaBhYKEAURHQHwUhAAGADgBgHyBnIIiq9NEmxBaEVMOWswQUFBQURBQWtDQlFFSXhKam5CeERvaXJVQ0dKQ2FrQU1nQnlnQVFNNkpvUWRJNUpDaEIxQ0hMVmlmS1hFATwJARRIZ0FnUUUJDAEBZElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoH0f4EugchTEwAGAAgADAAOLIEQADIB7_NBdIHDS0bBElAAR4I2gcGAftMGADgBwDqBwIIAPAH2v8YiggCEAA.&s=8d6293d02aebd4fa8057dbc1dca4cb8aa3f907cb&bdref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:42 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
0624799a-7097-4f49-aa5c-97f8632904bd
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 4248 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:35:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
537
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:35:45 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 4248 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu-jQ3ZFIeP2m3YpDFD8M42HxJeteEXHQQ6ppvzWsTHi1kLmOKxxZoO86HfAzWHIv7V0LGqylkojr_JlHw6vYeUE4fLRh-_aPmKOhiNOqdRX63bt7QYsR_uOZ9BG_7jljJ7SHvO1ZtxTkJ9Xg9gga8r24Z76h_XySSE&sig=Cg0ArKJSzONI7iW_fS1SEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.01022&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123302;dc_ver=81.236;dc_eid=40004001;sz=300x600;u_sd=1;gdpr=0;nel=1;dc_adk=2682109653;ord=up9pis;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Da6bb0b9f-340b-4bd4-b92a-1fc651fcbf46%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DSFcAtgCvs6oXQjMfVUyTkL0llbazjCTL1iXwOgbOYrQ.%26crid%3D8334xbua%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_300x250_300x600_160x600_Right_3%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=162;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 4248 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77571
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
MC_AM_IDEON_300x600_en.png
s0.2mdn.net/8497077/ Frame 4248 		97 KB
97 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/8497077/MC_AM_IDEON_300x600_en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
21762c5709391da7dbe652cf5703cfadac9180820048e4494fb2973fb7ddbfe5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 14:57:31 GMT
x-content-type-options
nosniff
age
38831
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
99642
x-xss-protection
0
last-modified
Wed, 10 Nov 2021 22:41:05 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 14:57:31 GMT
/
insight.adsrvr.org/enduser/pie/ 		807 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/pie/?pie=20&vet=0&rtb=dD0xJmlpZD1hNmJiMGI5Zi0zNDBiLTRiZDQtYjkyYS0xZmM2NTFmY2JmNDYmY3JpZD04MzM0eGJ1YSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02MzEwODg1NTQxMDk5NDA4MDg4JndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zL2JsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMyZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
async_usersync.html
acdn.adnxs.com/dmp/ Frame 09E2 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:44 GMT
Date
Sun, 05 Dec 2021 01:44:42 GMT
Connection
keep-alive
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame 4248 		0
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKePPBMHh4AAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9FMBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC_yAr8GCgtfX1RURF9DTEtfXxKvBiZpbXA9NDI5ZDA5ZGItMDUzNS00OGZiLWFlZWYtNDQ5YjFmMDY3MTJlJmFnPXZwamt2c20mc2ZlPTEzZTM5OTg1JnNpZz1jcEhqN3ZyYUZ4NVlXRV9FWGRoVEt0QjZjT0M2NklKZzc2Q3habTlnR2NJLiZjcmlkPWx3MnEydDd5JmNmPTI3MTYzMjkmZnE9MCZ0PTEmdGRfcz13d3cuYmxlZXBpbjITAfTTASZyY2F0cz0yZHgsb2JrLGpiYSx5dmIsM2dzJm1jYXQ9Jm1zdGU9Jm1mbGQ9NCZtc3NpPSZtZnNpPSZzdj1hcHBuZXh1cyZ1aG93PTE2NCZhZ3NhPSZ3cD0ke1BSSUNFX1BBSUR9JnJnej1IM0ImZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZzdnBpZD03MTI1JnJsYW5ncz1lbiZtbGFuZz0mZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZ0bXBjPS03LjI1JnZydGQ9Jm9zaT0mb3N2PSZkYWlkPSZkbnI9MCZ2cGI9JmM9Q2daRFlXNWhaR0VTQmxGMVpXSmxZeG9BSWdoTmIyNTBjbVZoYkRnQ1VBRllBb0FCQUlnQkFaQUJBQS4uJmR1cj1Da2dLSVdOb1lYSm5aUzFoYkd4TmIyRjBWbWxsZDJGaWFXeHBkSGxVY21GamEybHVaeUlqQ0tYX19fX19fX19fX3dFU0RtMXZZWFF0Y21Wd2IzSjBhVzVuS2dZSXdJUTlHQXcuJmR1cnM9eTZWRU13JmNycmVscj0mbnB0PSZtaz1Hb29nbGUmbWRsPUNocm9tZSUyMC0lMjBXaSlaOGFkcHQ9YW5vciZpcGw9YjoPAyhfNzI4eDkwXzk3MBEHODI1MF8zMjB4NTBfQVRGL8IyAEwmcGNtPTEmaWN0PVVua25vd24mcyF5ZDc0ODA0NzQ0MzEwNDUyMjAwNDImYXVjdD0xaUMMJSVUVGVDGCUlEq8GJmn-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwO6QwPIFQoRT1ZFUlJJREVfTUVUQURBVEESAPICDwoLTklFTFNFTl9UQUcSAPICDQoJTFVDSURfGRAUSVNQT1RfDRAMgQEKDmGLMFBJWEVMX0hFQUQSb2jtU3xueTEtYmlkLmFkc3J2ci5vcmcvYmlkL2ZlZWRiYWNrL9ELBD90gQMUaWQ9NDI5hgYHIGNyaWQ9bHcyccW9GHdwPfICnQcuhQAcVEFJTBKKByaFSPBYMTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZ0ZGlkPSZwaWQ9M2k4amI4aiZhZz12cGrlh_BpYWR2PW00Y3BuZGgmc2lnPTF3dG9YUDluemhac2dONHBtdi1JcXNZcVk4RWtOQURaWkJaQ1lIWFpKc3ZNLiZicD0yLjMzNDg1NzQ3NjQwODIxJmNmPTI3MTYzMjkmZnE9MCZ0ZF9zPXd3d1KcCOaJBwB1Nn0H8Wwgc3ZidHRkPTEmonUHCHJsYTZqBwRzdiEsIDcxMjUmZGlkPUp1B3BsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJv2SAGQhwSQmdnA9MCZvc2k96ZeKxQb-qQf-qQfuqQcAYf6BB9qBBwx2Yz0zZnoHLp8HAGHlhvCLJmltPTEmbWM9YWQwMzhmYjctNjMxZi00N2ZmLTg2ZmYtMmFmZDU0NzBkOWFm8gKlEgoUVklFV0FCSUxJVFlfVFJBQ0tJTkcSjBI8bm9zY3JpcHQgY2xhc3M9Ik1PQVQtdGhldHJhZGVkZXNrdjI3NTg3NDU2ODc0OD9tb2F0Q2xpZW50TGV2ZWwxPW1tgAxhbXA7Oh0AIDI9YXcyd2xzN04dAAQzPXXGMjoAGFNsaWNlcjFmdQMBLzx6TW9hdEltcHJlc3Npb25JmrwEFTtEQ2FjaGVidXN0ZXI9MTI3MjU4GRwgUGFydG5lcklEmXIEbXAJciRWaWV3VHlwZT0wGS8cQ3JlYXRpdmW5FBUvFERlYWxJRHWEFRgwU3VwcGx5VmVuZG9yPbGGHR8IaXRliv8AGFB1Ymxpc2gFqmXwAWA6ggEgND0tIj48L25vKeQEPjwJCBQgc3JjPSLRKAR6LgE2JGFkcy5jb20vdGha-wEALwkmDC5qcyMBClIFAjoZAFkBOhkAOf0ZGYL5Adr1AQU3SvEBBRhG7QEFFz3pBRBG5QEFFzrhAQUUVt0BCRty2QEFI0LVATkgGExldmVsND0htjwlM0ElMkYlMkZpbnNpZ2h0_eM8JTJGZW5kdXNlciUyRnBpZQEoADMFCTAzRDIwJTI2dmV0JTNELg4E8HlFVkVOVF9UWVBFJTI2cnRiJTNEZEQweEptbHBaRDAwTWpsa01EbGtZaTB3TlRNMUxUUTRabUl0WVdWbFppMDBORGxpTVdZd05qY3hNbVVtWTNKcFpEMXNkekp4TW5RM2VTWjNjRDBrZTFCU1NVTkZYMUJCU1VSOUptRgFg8FgzTVRZM01EVTJORFl5TXpBNE1UZzNPRGt5Sm5kd1l6MVZVMFFtYzJabFBURXpaVE01T1RnMUpuQjFhV1E5T0RrNE56TXdOREU1TWpjM05UUTVOVEk1TnladwEg9GwETTJrNGFtSTRhaVpoWnoxMmNHcHJkbk50Sm1Ga2RqMXROR053Ym1Sb0ptSndQVEl1TXpNME9EVTNORGMyTkRBNE1qRW1ZMlk5TWpjeE5qTXlPU1ptY1Qwd0puUmtYM005ZDNkM0xtSnNaV1Z3YVc1blkyOXRjSFYwWlhJdVkyOXRKbkpqWVhSelBUSmtlQ3h2WW1zc2FtSmhMSGwyWWl3elozTW1iV05oZEQwbWJYTjBaVDBtYldac1pEMDBKbTF6YzJrOUptMW1jMms5Sm5Wb2IzYzlNVFkwSm1GbmMyRTlKbkpuZWoxSU0wSW1jM1ppZEhSa1BURW1aSFE5VUVNbWIzTm1QVmRwYm1SdmQzTW1iM005VjJsdVpHOTNjekV3Sm1KeVBVTm9jbTl0WlNaeWJHRnVaM005Wlc0bWJXeGhibWM5Sm5OMmNHbGtQVGN4TWpVbVpHbGtQVEV5TmpjMU9UUW1jbU40ZEQxUGRHaGxjaVpzWVhROU5EVXVORGs1TkRBd0pteHZiajB0TnpNdU5UY3dNekF3Sm5SdGNHTTlMVGN1TWpVbVpHRnBaRDBtZG5BOU1DWnZjMms5Sm05emRqMG1iV3M5UjI5dloyeGxKbTFrYkQxRGFISnZiV1VsTWpBdEpUSXdWMmx1Wkc5M2N5WmpQVU5uV2tSWlZ6Vm9Xa2RGVTBKc1JqRmFWMHBzV1hodlFVbG5hRTVpTWpVd1kyMVdhR0pFWjBOVlFVWlpRVzlCUWtGSlowSkJXa0ZDUVVFdUxpWmtkWEk5UTJ0blMwbFhUbTlaV0VwdVdsTXhhR0pIZUU1aU1rWXdWbTFzYkdReVJtbGhWM2h3WkVoc1ZXTnRSbXBoTW14MVdubEpha05MV0Y5ZlgxOWZYMTlmWDE5M1JWTkViVEYyV1ZoUmRHTnRWbmRpTTBvd1lWYzFia3RuV1VsM1NWRTVSMEYzTGlaamNuSmxiSEk5Sm1Ga2NIUTlZVzV2Y2lacGNHdzlZbXhsWlhCcGJtZGpiMjF3ZFhSbGNsODNNamg0T1RCZk9UY3dlRGt3WHprM01IZ3lOVEJmTXpJd2VEVXdYMEZVUmk5aWJHVmxjR2x1WjJOdmJYQjFkR1Z5WHpjeU9IZzVNRjg1TnpCNE9UQmZPVGN3ZURJMU1GOHpNakI0TlRCZlFWUkdKbkJqYlQweEpuWmpQVE1tYzJGcFpEMDNORGd3TkRjME5ETXhNRFExTWpJd01EUXlKbWxqZEQxVmJtdHViM2R1Sm1GMVkzUTlNU1pwYlQweEptMWpQV0ZrTURNNFptSTNMVFl6TVdZdE5EZG1aaTA0Tm1abUxUSmhabVExTkRjd1pEbGhaaVp6ZGoxaGNIQnVaWGgxY3cuLiIgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij48L3NjcmlwdD7yAhUKEVJFRkVSUkVSX1RSQUNLSU5HEgDyAhUKC0NBQ0hFQlVTVEVSEgY2OTgwNDHyAiAKBFNJVEUSGHd3dy4-fhHhTxzyAocBChZfXw6kDURTSVRFX1dJVEhfUEFUSF9fEm1e4hMsJTJmbmV3cyUyZnNlFvkUECUyZmVt6vsUHCUyZvICEAoMCYowVERJRF9fEgDyAhwKEQkTGFBBUlRORVIFGDAHM2k4amI4avICHQoVPh8APElOVF9fEgQyMDY18gIfChQJIBxBRFZFUlRJUxFCGpYNEPICIgoYSiIACUUYBjM0OTczMwFnABIJJRxDQU1QQUlHTgmHGj4KCPICITFDHSAJQxwHMTk4MzEzNB3KGEFER1JPVVAJQxpkCgFDDcoZHwlCLAgxMDExNDYxMfICHhWHGFJFQVRJVkUFRAAIHu0OAc0tyx0hDUYwMjEwOTQ3NTbyAhoKEAnNGEFERk9STUEhLwQGNxK7EwjyAiAxMTxTVVBQTFlWRU5ET1JfXxIIHgcKIQ0tMjIjAAlnEAE38gI8EUMgSU1QUkVTU0lPKS8AJI6_DwjyAhQRnxxDQVRFR09SWUkJABgR_BRERVZJQ0UODgggX18SAlBD8gIZMTsAThqcEAhQQ18lGgAAHU4JNxEXCCAKGykELmgIFFBST0ZJTAFXGAEw8gIWCgsJIwBMJSIABxqTDgjyAhhRpgxMT05HIRsenw4BigAPCTQQQ09VTlQFuxgGQ2FuYWRhITcAEzYcABBFTkNfXxkgCBgKDgkgFFJFR0lPTgEbFFF1ZWJlY0E7TX8NGw06ER8IEQoNCToQTUVUUk8pLwAWEYoUWklQQ09EAdUMA0gzQiH-DYcRGQlNCR0V2wBDDoYNKF8SCE1vbnRyZWFsAYRNNgUbCTUdHwQWCm2oGFRSVVNURVMlaSFHABkR1wxERUFMBRYABxr0DwzyAhsKTa8UTElNSVRfHvYNBF9fBToIIgodCdcx1yxJTkFQUF9PUFRfT1VBtQFfCCQKGQklJFBSSVZBVEVDT04BRwBUCWosamZzemQwM_ICKQoaHScEQ1ktSS0aOAt0cmFkZWRlc2swMfICJBGWaFVOSVhfVElNRVNUQU1QX18SCjE2Mzg2Njg2N2X0DZ9IRENPX01BUFBJTkdSVUxFX01BQzGGFeFJfhhPU0ZBTUlMQdIEATJBYi1TGExBTkdVQUchpQgCZW5hxw3VJFJFTkRFUklOR18B2ARFWAH2KAVPdGhlcvICIwofCdMsQ1VTVE9NQklEREVSNUQlAAQA8lkcDEdFTlIBYQAAIXdNAxhQVUJMSVNIrRQABA6lDUHErTMsR0RQUl9BUFBMSUVTLZMAH3E3BRwMQ09OUw6aCwRTVAWjpbAAGjE9MpYAADFuHQAAMm4dAAAzAR3wdYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA_vvGOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4zNy4xMjAuMjA1LjE4MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8AQSSxxUiAUBmAUAoAXK7d7uyfv-52fABQDJBQ6XHBwAAPA_0gUJCQkM8EkAANgFAeAFAeoFFwoNZnNfYWRfcHJvZHVjdBIGYmFubmVy8AWoA_oFBAgAEACQBgCYBgCiBg43MTI1I05ZTTI6NTI3ObgGAMEGAAVQLPA_0AbE0AHaBhYKEAURHQHwUhAAGADgBgHyBnIIiq9NEmxBaEVMOWswQUFBQURBQWtDQlFFSXhKam5CeERvaXJVQ0dKQ2FrQU1nQnlnQVFNNkpvUWRJNUpDaEIxQ0hMVmlmS1hFATwJARRIZ0FnUUUJDAEBZElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoH0f4EugchTEwAGAAgADAAOLIEQADIB7_NBdIHDS0bBElAAR4I2gcGAftMGADgBwDqBwIIAPAH2v8YiggCEAA.&s=8d6293d02aebd4fa8057dbc1dca4cb8aa3f907cb&bdref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:42 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
7486aa2e-d802-418f-9749-0b9f4be15e7f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
MC_AM_IDEON_728x90_en.png
s0.2mdn.net/8497077/ Frame ADE7 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/8497077/MC_AM_IDEON_728x90_en.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
50cc2ba64721a6489beb02e7470f1d753cf0b02c4868f47e5ef8a975ec7fa1d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 12:25:25 GMT
x-content-type-options
nosniff
age
47957
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32101
x-xss-protection
0
last-modified
Wed, 10 Nov 2021 22:41:10 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 12:25:25 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame ADE7 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:35:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
537
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:35:45 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame ADE7 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsslVm4FYVOIvCxyz2ykUnu09NPN5k5TXFSyYr5iV9x-Y-7j6olof0Rnvtkhfz0Tlr-VEU3ftbBYRr7vYLZtCbDh6vVuvRSx8ca_Yziv5ssbi0x2TKdljQpUQ22BWYFBUdxCYEA1ofyVOFoe76XFuKk-z-yGGaROn76c&sig=Cg0ArKJSzIhbA5ttlJL6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211201.96314&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3656561802;ord=1dyeb6;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Dcb4f6517-8ebb-4b3f-9a53-8d7653aefd9e%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DVSqHg-He5LQjoOfQ1keUYzvdmJSnMkGrvMy3_9v2eXY.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=158;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame ADE7 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77571
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
/
insight.adsrvr.org/enduser/pie/ 		807 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/pie/?pie=20&vet=0&rtb=dD0xJmlpZD1jYjRmNjUxNy04ZWJiLTRiM2YtOWE1My04ZDc2NTNhZWZkOWUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD04MjY1Mjg2NTc4NTc5MjIyMjEwJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0JURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQlRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
async_usersync.html
acdn.adnxs.com/dmp/ Frame 2D75 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:45 GMT
Date
Sun, 05 Dec 2021 01:44:43 GMT
Connection
keep-alive
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame ADE7 		0
805 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKePPBMHh4AAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9FMBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC_yAr8GCgtfX1RURF9DTEtfXxKvBiZpbXA9NDI5ZDA5ZGItMDUzNS00OGZiLWFlZWYtNDQ5YjFmMDY3MTJlJmFnPXZwamt2c20mc2ZlPTEzZTM5OTg1JnNpZz1jcEhqN3ZyYUZ4NVlXRV9FWGRoVEt0QjZjT0M2NklKZzc2Q3habTlnR2NJLiZjcmlkPWx3MnEydDd5JmNmPTI3MTYzMjkmZnE9MCZ0PTEmdGRfcz13d3cuYmxlZXBpbjITAfTTASZyY2F0cz0yZHgsb2JrLGpiYSx5dmIsM2dzJm1jYXQ9Jm1zdGU9Jm1mbGQ9NCZtc3NpPSZtZnNpPSZzdj1hcHBuZXh1cyZ1aG93PTE2NCZhZ3NhPSZ3cD0ke1BSSUNFX1BBSUR9JnJnej1IM0ImZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZzdnBpZD03MTI1JnJsYW5ncz1lbiZtbGFuZz0mZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZ0bXBjPS03LjI1JnZydGQ9Jm9zaT0mb3N2PSZkYWlkPSZkbnI9MCZ2cGI9JmM9Q2daRFlXNWhaR0VTQmxGMVpXSmxZeG9BSWdoTmIyNTBjbVZoYkRnQ1VBRllBb0FCQUlnQkFaQUJBQS4uJmR1cj1Da2dLSVdOb1lYSm5aUzFoYkd4TmIyRjBWbWxsZDJGaWFXeHBkSGxVY21GamEybHVaeUlqQ0tYX19fX19fX19fX3dFU0RtMXZZWFF0Y21Wd2IzSjBhVzVuS2dZSXdJUTlHQXcuJmR1cnM9eTZWRU13JmNycmVscj0mbnB0PSZtaz1Hb29nbGUmbWRsPUNocm9tZSUyMC0lMjBXaSlaOGFkcHQ9YW5vciZpcGw9YjoPAyhfNzI4eDkwXzk3MBEHODI1MF8zMjB4NTBfQVRGL8IyAEwmcGNtPTEmaWN0PVVua25vd24mcyF5ZDc0ODA0NzQ0MzEwNDUyMjAwNDImYXVjdD0xaUMMJSVUVGVDGCUlEq8GJmn-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwP-QwO6QwPIFQoRT1ZFUlJJREVfTUVUQURBVEESAPICDwoLTklFTFNFTl9UQUcSAPICDQoJTFVDSURfGRAUSVNQT1RfDRAMgQEKDmGLMFBJWEVMX0hFQUQSb2jtU3xueTEtYmlkLmFkc3J2ci5vcmcvYmlkL2ZlZWRiYWNrL9ELBD90gQMUaWQ9NDI5hgYHIGNyaWQ9bHcyccW9GHdwPfICnQcuhQAcVEFJTBKKByaFSPBYMTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZ0ZGlkPSZwaWQ9M2k4amI4aiZhZz12cGrlh_BpYWR2PW00Y3BuZGgmc2lnPTF3dG9YUDluemhac2dONHBtdi1JcXNZcVk4RWtOQURaWkJaQ1lIWFpKc3ZNLiZicD0yLjMzNDg1NzQ3NjQwODIxJmNmPTI3MTYzMjkmZnE9MCZ0ZF9zPXd3d1KcCOaJBwB1Nn0H8Wwgc3ZidHRkPTEmonUHCHJsYTZqBwRzdiEsIDcxMjUmZGlkPUp1B3BsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJv2SAGQhwSQmdnA9MCZvc2k96ZeKxQb-qQf-qQfuqQcAYf6BB9qBBwx2Yz0zZnoHLp8HAGHlhvCLJmltPTEmbWM9YWQwMzhmYjctNjMxZi00N2ZmLTg2ZmYtMmFmZDU0NzBkOWFm8gKlEgoUVklFV0FCSUxJVFlfVFJBQ0tJTkcSjBI8bm9zY3JpcHQgY2xhc3M9Ik1PQVQtdGhldHJhZGVkZXNrdjI3NTg3NDU2ODc0OD9tb2F0Q2xpZW50TGV2ZWwxPW1tgAxhbXA7Oh0AIDI9YXcyd2xzN04dAAQzPXXGMjoAGFNsaWNlcjFmdQMBLzx6TW9hdEltcHJlc3Npb25JmrwEFTtEQ2FjaGVidXN0ZXI9MTI3MjU4GRwgUGFydG5lcklEmXIEbXAJciRWaWV3VHlwZT0wGS8cQ3JlYXRpdmW5FBUvFERlYWxJRHWEFRgwU3VwcGx5VmVuZG9yPbGGHR8IaXRliv8AGFB1Ymxpc2gFqmXwAWA6ggEgND0tIj48L25vKeQEPjwJCBQgc3JjPSLRKAR6LgE2JGFkcy5jb20vdGha-wEALwkmDC5qcyMBClIFAjoZAFkBOhkAOf0ZGYL5Adr1AQU3SvEBBRhG7QEFFz3pBRBG5QEFFzrhAQUUVt0BCRty2QEFI0LVATkgGExldmVsND0htjwlM0ElMkYlMkZpbnNpZ2h0_eM8JTJGZW5kdXNlciUyRnBpZQEoADMFCTAzRDIwJTI2dmV0JTNELg4E8HlFVkVOVF9UWVBFJTI2cnRiJTNEZEQweEptbHBaRDAwTWpsa01EbGtZaTB3TlRNMUxUUTRabUl0WVdWbFppMDBORGxpTVdZd05qY3hNbVVtWTNKcFpEMXNkekp4TW5RM2VTWjNjRDBrZTFCU1NVTkZYMUJCU1VSOUptRgFg8FgzTVRZM01EVTJORFl5TXpBNE1UZzNPRGt5Sm5kd1l6MVZVMFFtYzJabFBURXpaVE01T1RnMUpuQjFhV1E5T0RrNE56TXdOREU1TWpjM05UUTVOVEk1TnladwEg9GwETTJrNGFtSTRhaVpoWnoxMmNHcHJkbk50Sm1Ga2RqMXROR053Ym1Sb0ptSndQVEl1TXpNME9EVTNORGMyTkRBNE1qRW1ZMlk5TWpjeE5qTXlPU1ptY1Qwd0puUmtYM005ZDNkM0xtSnNaV1Z3YVc1blkyOXRjSFYwWlhJdVkyOXRKbkpqWVhSelBUSmtlQ3h2WW1zc2FtSmhMSGwyWWl3elozTW1iV05oZEQwbWJYTjBaVDBtYldac1pEMDBKbTF6YzJrOUptMW1jMms5Sm5Wb2IzYzlNVFkwSm1GbmMyRTlKbkpuZWoxSU0wSW1jM1ppZEhSa1BURW1aSFE5VUVNbWIzTm1QVmRwYm1SdmQzTW1iM005VjJsdVpHOTNjekV3Sm1KeVBVTm9jbTl0WlNaeWJHRnVaM005Wlc0bWJXeGhibWM5Sm5OMmNHbGtQVGN4TWpVbVpHbGtQVEV5TmpjMU9UUW1jbU40ZEQxUGRHaGxjaVpzWVhROU5EVXVORGs1TkRBd0pteHZiajB0TnpNdU5UY3dNekF3Sm5SdGNHTTlMVGN1TWpVbVpHRnBaRDBtZG5BOU1DWnZjMms5Sm05emRqMG1iV3M5UjI5dloyeGxKbTFrYkQxRGFISnZiV1VsTWpBdEpUSXdWMmx1Wkc5M2N5WmpQVU5uV2tSWlZ6Vm9Xa2RGVTBKc1JqRmFWMHBzV1hodlFVbG5hRTVpTWpVd1kyMVdhR0pFWjBOVlFVWlpRVzlCUWtGSlowSkJXa0ZDUVVFdUxpWmtkWEk5UTJ0blMwbFhUbTlaV0VwdVdsTXhhR0pIZUU1aU1rWXdWbTFzYkdReVJtbGhWM2h3WkVoc1ZXTnRSbXBoTW14MVdubEpha05MV0Y5ZlgxOWZYMTlmWDE5M1JWTkViVEYyV1ZoUmRHTnRWbmRpTTBvd1lWYzFia3RuV1VsM1NWRTVSMEYzTGlaamNuSmxiSEk5Sm1Ga2NIUTlZVzV2Y2lacGNHdzlZbXhsWlhCcGJtZGpiMjF3ZFhSbGNsODNNamg0T1RCZk9UY3dlRGt3WHprM01IZ3lOVEJmTXpJd2VEVXdYMEZVUmk5aWJHVmxjR2x1WjJOdmJYQjFkR1Z5WHpjeU9IZzVNRjg1TnpCNE9UQmZPVGN3ZURJMU1GOHpNakI0TlRCZlFWUkdKbkJqYlQweEpuWmpQVE1tYzJGcFpEMDNORGd3TkRjME5ETXhNRFExTWpJd01EUXlKbWxqZEQxVmJtdHViM2R1Sm1GMVkzUTlNU1pwYlQweEptMWpQV0ZrTURNNFptSTNMVFl6TVdZdE5EZG1aaTA0Tm1abUxUSmhabVExTkRjd1pEbGhaaVp6ZGoxaGNIQnVaWGgxY3cuLiIgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij48L3NjcmlwdD7yAhUKEVJFRkVSUkVSX1RSQUNLSU5HEgDyAhUKC0NBQ0hFQlVTVEVSEgY2OTgwNDHyAiAKBFNJVEUSGHd3dy4-fhHhTxzyAocBChZfXw6kDURTSVRFX1dJVEhfUEFUSF9fEm1e4hMsJTJmbmV3cyUyZnNlFvkUECUyZmVt6vsUHCUyZvICEAoMCYowVERJRF9fEgDyAhwKEQkTGFBBUlRORVIFGDAHM2k4amI4avICHQoVPh8APElOVF9fEgQyMDY18gIfChQJIBxBRFZFUlRJUxFCGpYNEPICIgoYSiIACUUYBjM0OTczMwFnABIJJRxDQU1QQUlHTgmHGj4KCPICITFDHSAJQxwHMTk4MzEzNB3KGEFER1JPVVAJQxpkCgFDDcoZHwlCLAgxMDExNDYxMfICHhWHGFJFQVRJVkUFRAAIHu0OAc0tyx0hDUYwMjEwOTQ3NTbyAhoKEAnNGEFERk9STUEhLwQGNxK7EwjyAiAxMTxTVVBQTFlWRU5ET1JfXxIIHgcKIQ0tMjIjAAlnEAE38gI8EUMgSU1QUkVTU0lPKS8AJI6_DwjyAhQRnxxDQVRFR09SWUkJABgR_BRERVZJQ0UODgggX18SAlBD8gIZMTsAThqcEAhQQ18lGgAAHU4JNxEXCCAKGykELmgIFFBST0ZJTAFXGAEw8gIWCgsJIwBMJSIABxqTDgjyAhhRpgxMT05HIRsenw4BigAPCTQQQ09VTlQFuxgGQ2FuYWRhITcAEzYcABBFTkNfXxkgCBgKDgkgFFJFR0lPTgEbFFF1ZWJlY0E7TX8NGw06ER8IEQoNCToQTUVUUk8pLwAWEYoUWklQQ09EAdUMA0gzQiH-DYcRGQlNCR0V2wBDDoYNKF8SCE1vbnRyZWFsAYRNNgUbCTUdHwQWCm2oGFRSVVNURVMlaSFHABkR1wxERUFMBRYABxr0DwzyAhsKTa8UTElNSVRfHvYNBF9fBToIIgodCdcx1yxJTkFQUF9PUFRfT1VBtQFfCCQKGQklJFBSSVZBVEVDT04BRwBUCWosamZzemQwM_ICKQoaHScEQ1ktSS0aOAt0cmFkZWRlc2swMfICJBGWaFVOSVhfVElNRVNUQU1QX18SCjE2Mzg2Njg2N2X0DZ9IRENPX01BUFBJTkdSVUxFX01BQzGGFeFJfhhPU0ZBTUlMQdIEATJBYi1TGExBTkdVQUchpQgCZW5hxw3VJFJFTkRFUklOR18B2ARFWAH2KAVPdGhlcvICIwofCdMsQ1VTVE9NQklEREVSNUQlAAQA8lkcDEdFTlIBYQAAIXdNAxhQVUJMSVNIrRQABA6lDUHErTMsR0RQUl9BUFBMSUVTLZMAH3E3BRwMQ09OUw6aCwRTVAWjpbAAGjE9MpYAADFuHQAAMm4dAAAzAR3wdYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA_vvGOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4zNy4xMjAuMjA1LjE4MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8AQSSxxUiAUBmAUAoAXK7d7uyfv-52fABQDJBQ6XHBwAAPA_0gUJCQkM8EkAANgFAeAFAeoFFwoNZnNfYWRfcHJvZHVjdBIGYmFubmVy8AWoA_oFBAgAEACQBgCYBgCiBg43MTI1I05ZTTI6NTI3ObgGAMEGAAVQLPA_0AbE0AHaBhYKEAURHQHwUhAAGADgBgHyBnIIiq9NEmxBaEVMOWswQUFBQURBQWtDQlFFSXhKam5CeERvaXJVQ0dKQ2FrQU1nQnlnQVFNNkpvUWRJNUpDaEIxQ0hMVmlmS1hFATwJARRIZ0FnUUUJDAEBZElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoH0f4EugchTEwAGAAgADAAOLIEQADIB7_NBdIHDS0bBElAAR4I2gcGAftMGADgBwDqBwIIAPAH2v8YiggCEAA.&s=8d6293d02aebd4fa8057dbc1dca4cb8aa3f907cb&bdref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
53f8b038-02d0-4c03-8afd-12ec571c2186
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 5491 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv4e55fSmXznRZN-GlS27Lv7yQYXn52E3hbqDf4jMpAa73DmqAQulmtxG1dkZ8FQHeb9MR-EP6D-8d1plYhQhz7VtJws9d-kIAH8Gev3r7bm-dKw6bIiBBLYSn4pt61i_vKORVU0Gw9d7Zh8Kez-0XHV79hVQVhTyNI&sig=Cg0ArKJSzJYqt5uE3PrMEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=645&vt=11&dtpt=644&dett=2&cstd=0&cisv=r20211201.87375&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=1601075548;ord=gfdeti;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D944e8539-133d-4ade-8716-db20c61496c3%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DA_60XKNU9FyhvExmfc84nFoc-OMFgxwnwJdvBgoFT-c.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_320x50_InContent_1%2Fbleepingcomputer_728x90_320x50_InContent_1%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=99;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame 5491 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss_JTNqYOS5brZK-h-QnIBlsHtaNEHaq12OydkW3jaoBES6IKYEa1wbIuo63jSwSFmoKFrW152NwR0N8k6OmIpmZMd3tBwtqP86U6wZfCIUn8lrTxU2sjGrKNiL6mIgrChtZ0_31aqSdOxe1HVgd8x5LrouPiLbVJ0W5MVSx_1zEK8ZhR2oWzIOzxIrPzJ9R0cnyNyBarzvkYTJB67mNr8C1uPqumPoHGWW1-jMLJoqAbnfBY5VFzEuLmrJMQ1MPLWptAc-3K8D4jAxwvxTb5YBPg6qzaPZEC2Wp7A3dQGCzncSnaZk_bRi_7Z0kh8uwmr5joOCgzSR-YD11EeF-qWcG6aSg1gFyUPlf1G_maVyooLl&sig=Cg0ArKJSzGwNnsVihkCSEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Sun, 05 Dec 2021 01:44:43 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8497077%2FMC_AM_IDEON_728x90_en.png&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=8&f=0&j=&t=1638668682370&de=446533987442&cu=1638668682370&m=110&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A512%3A512%3A0%3A602&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=74&cd=0&ah=74&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=830023&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=944e8539-133d-4ade-8716-db20c61496c3&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD05NDRlODUzOS0xMzNkLTRhZGUtODcxNi1kYjIwYzYxNDk2YzMmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02Njc3MDgzNzgwMTQxMjc3MzMzJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfMzIweDUwX0luQ29udGVudF8xL2JsZWVwaW5nY29tcHV0ZXJfNzI4eDkwXzMyMHg1MF9JbkNvbnRlbnRfMSZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=DOMSEARCH&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&ti=0&ih=1&jk=-1&jm=1&tc=0&fs=195402&na=661956591&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:43 GMT
834b0b92-82e7-4f6b-aa2c-c0b46affd41e.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/834b0b92-82e7-4f6b-aa2c-c0b46affd41e.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e33b0e88e98b044bb7339fe15b58a8da3cdbb95ae3c5e5fec466f642ec7cc1a1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
content-encoding
br
age
876
etag
"vRd9BuQwXB18EkVxsaGxV0vf0Zq0haX6c1+qThijWkc"
access-control-max-age
86400
fastly-io-info
ifsz=62026 idim=1600x900 ifmt=jpeg ofsz=14621 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
14086
view
googleads4.g.doubleclick.net/pcs/ Frame F0A3 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvsRcvs6hxL_5wZUhSP-g0MfGAe5cBzTjf3jZ4XGb07xgqAbXwyi_ByW9Gu66_-XTnojHvuG9EY-LHa0uTZijKW_-Fr4z2aMxCO14KOb4p0XN-5ybA63Qgh4ya9EjGE2MDd-D7o35k9zcgPDAIBxXO-KMXDhjenvLqa&sig=Cg0ArKJSzCgqJbRAe5a7EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=506&vt=11&dtpt=505&dett=2&cstd=0&cisv=r20211201.58979&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3492570197;ord=2a5py5;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D429d09db-0535-48fb-aeef-449b1f06712e%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DcpHj7vraFx5YWE_EXdhTKtB6cOC66IJg76CxZm9gGcI.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=109;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame F0A3 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvTaIWcifxhlGUFjhyoNJIO-UXk018-s2dkyYox8w-WgmlOyFUfA3kwLCgQfjLxKTah3ZFUkWBz_qDE0ljhNtJrL5rBlY4diOu_8_QVRt84T9IRVdLYSSOggPmp23WC_Q1Q6dF1QHUIj8iRZmuwMjstJT5C-lr4HtpRVpHlgbz6M0YnvdjOJjOZNEy8Vq8XRJROrJ2hjbkTnkGroySaVGYi5HuWPSJ17P2j25_0S2rnesiorCbT-5bkkjydb9YTCozp4rLU1vXqKSUDnqxxytjAZYi4_EJSpOf9jq8s4Eb1X9t6jiLwDVw7AI3kgjXGpBDcwRfxkehw031vIOxYDVsEcZnwR-tONHJLT7sdDBWhDxTTOGvaTXMNLw&sig=Cg0ArKJSzME-vLKcE-WpEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Sun, 05 Dec 2021 01:44:43 GMT
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 675F 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113355
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9a0fbde3-9ae8-f13c-53d9-a0aff1deee14&tv=%7Bc:vSM0UM,pingTime:-10,time:1568,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuNDUgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000020000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1638668682595%7C%7C8a666fe60c44d090fb009b78565b223c%7C%7Cb4088f046bf9a570f2964ffc86d258ff%7C%7Ce6a68714d192b613b4f5f8d28e96f81b%7C%7C78a63098db532ca2343bc8fffe809565%7C%7C98412207097f34991e50fbb62197161b%7C%7Cd20797966432dba3574fcefea33235bd%7C%7C54abd9123040dcb985671a8f61cb9ea9%7C%7C1629390669,im:%7Bimprf:%7Bttecl:1011,ecd:26,tsecr:187%7D%7D,sca:%7Bspg:9ef1eab2-63bf-ab8a-ec9f-720656398207%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
x-server-name
dt10.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
activeview
pagead2.googlesyndication.com/pcs/ Frame 5C28 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuZ7NcjB0gzytpKNp5L_uLBgU0ipwtWO_rVIJ2cQoM87_gkKUQrOlaauHxFjvtuY4cLe9eNLZ4v693cBBibGZR64xk6rbt6vW-f_p7pFSNlLyE5kOM&sai=AMfl-YThIUcwXuDSf3cxnw7MujLi7kwA7gD1O_RDYEyM9u0hmZsNDkQtstUPEzN-sOC6Vd8-Kma00haSMxaQdWt0YVwepvBPGYPhEY9Y7SD8lrWJjO1DsvpPXcAUD2o&sig=Cg0ArKJSzOVPaY46qW8GEAE&cid=CAASEuRodiUmuomIdaeWxgDcxuY7PQ&id=lidar2&mcvt=1288&p=1110,315,1204,1285&mtos=0,1288,1288,1288,1288&tos=0,1288,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=3056404191&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638668678581&rpt=3274&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame 5491 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0e61d9c07f949b822eb61a32c30fe7daaac55426d4f1b88e55da0782aa3ce75e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
140852976f26386afd24e8b07c5fd1c4f43c4bf004236d3bd3a704ee154e99f9

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
content-encoding
br
age
888
etag
"MuFENSRXK5Jlill46k64v/R72jdsibjq/2JyXRBFB6s"
access-control-max-age
86400
fastly-io-info
ifsz=110792 idim=1600x900 ifmt=jpeg ofsz=30774 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
30329
vpaid_25214542.js
vpaid.springserve.com/production/ Frame 3FC7 		495 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpaid.springserve.com/production/vpaid_25214542.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:9400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 01:33:13 GMT
content-encoding
br
last-modified
Fri, 19 Nov 2021 18:30:16 GMT
server
AmazonS3
age
519091
etag
W/"185feb14359001049d144410afbeaaa4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 aa7679f2d01b23d9a66bfa6e92991b05.cloudfront.net (CloudFront)
cache-control
max-age=2678400
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
10qsthwdkWKvWrkPACnY7g08QYsI4ODsysBmicIFnOWcjrq4tPFdIQ==
truncated
/ Frame F0A3 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b52e00ba53f3251c17bf03da702ed83fc5d7bd2937aef4a7d034b01485f80032

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
view
googleads4.g.doubleclick.net/pcs/ Frame 08B5 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvLk3wEUt21TDa8zCYxTJvNPSlT6WwFEbUSAgZzLzop8kSL-ZCXE-vNMB6MGAz5G82WB8GxkF48shPxUakoDZO44WIp62vpqi1c7UajWl0LFyPC5TZz22XFmRrsdS5zBOfrStOcN-b5bx8ZtU2BGqyRJwMHctevRAmF&sig=Cg0ArKJSzFVCyrM0CC-8EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=564&vt=11&dtpt=563&dett=2&cstd=0&cisv=r20211201.38737&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123311;dc_ver=81.236;dc_eid=40004000;sz=300x250;u_sd=1;gdpr=0;nel=1;dc_adk=2728075850;ord=bkmt7m;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3D9090efe1-fb9c-442d-803b-1d7ac113fa60%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DkvI8Wud95h7zeh0LKc1MLDG_Mcpup3-fweibDHVG94k.%26crid%3Doybxzi69%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_300x250_300x600_160x600_Right_2%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=156;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame 08B5 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfQIPsNZljer2R2cSPp9x_Gkw42WHq2L878J6DbTPYX14mnjNzjXZoXPsMX54ZIbyNpgT_q4CsJyUWDhwCsqjU0S91aWEpkswVmCEDRLrxWqVESjRTXC9_N-PJLErFn8xrBRy65OflsX9jc-SW-Bf3LiwnLD583dp0iUC4DQJX4-dnryN1h2tmjuhweAnk_bHZRKrPRtW8ep47z2gyulMUU5LRKKvW6yxFUxk-Uf6YhJrMOyoaR0nG-sv1gxXCEhH-5iJ6WKDCUWy8fVZYfjBcZiKnGZ9p7wqYhQHjcKgHoSUw_iKGKMCJC1_GODr1pl_JI-FzBTxnVRMyxpeBsYi4q3U9OUbT3R3tTFI-h4VhXhs17KQJ4FOW&sig=Cg0ArKJSzNyje24ge8ATEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Sun, 05 Dec 2021 01:44:43 GMT
vevent
nym1-ib.adnxs.com/ Frame 5491 		0
836 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKXBvBMFwMAAAMA1gAFAQiFs7CNBhCVwd-WpIrx1FwYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9KgBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAqLPXOoCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC-AAwCIAwGQAwCYAxegAwGqAyoaEzY2NzcwODM3ODAxNDEyNzczMzMqBDIwNjU6DW9ydGItbHcycTJ0N3nAA6wCyAMA2AP77xjgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMzcuMTIwLjIwNS4xODKoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAElvqQmgGIBQGYBQCgBcrt3u7J-_7nZ8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBagD-gUECAAQAJAGAJgGAKIGDjcxMjUjTllNMjo1Mjc5uAYAwQYAAAAAAADwP9AGxNAB2gYWChAh_S4BAPBSEAAYAOAGAfIGcgiKr00SbEFoRUw5azBBQUFBREFBa0NCUUVJeEpqbkJ4RG9pclVDR0pDYWtBTWdCeWdBUU02Sm9RZEk1SkNoQjFDSExWaWZLWEUBPAkBFEhnQWdRRQkMAQHwPElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoHB2F3Mndscze6Bw8IABAAGAAgADAAOLIEQADIB7_NBdIHDQkJtgRJQAEeCNoHBgknROAHAOoHAggA8Afa_xiKCAIQAA..&s=4d911b1796528aa9c931aade65e57078fcb184ab&type=nv&nvt=5&jm=1003&px=268&py=5433&bw=728&bh=90&sid=6752841121935943592&vd=ct~0|rr~0&sv=221&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=13830953&sw=1600&sh=1200&pw=1600&ph=7725&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
01b41a41-9b6f-4bdb-a34d-2e673a08dd82
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame ADE7 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsslVm4FYVOIvCxyz2ykUnu09NPN5k5TXFSyYr5iV9x-Y-7j6olof0Rnvtkhfz0Tlr-VEU3ftbBYRr7vYLZtCbDh6vVuvRSx8ca_Yziv5ssbi0x2TKdljQpUQ22BWYFBUdxCYEA1ofyVOFoe76XFuKk-z-yGGaROn76c&sig=Cg0ArKJSzIhbA5ttlJL6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=461&vt=11&dtpt=461&dett=2&cstd=0&cisv=r20211201.96314&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123305;dc_ver=81.236;dc_eid=40004001;sz=728x90;u_sd=1;gdpr=0;nel=1;dc_adk=3656561802;ord=1dyeb6;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Dcb4f6517-8ebb-4b3f-9a53-8d7653aefd9e%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DVSqHg-He5LQjoOfQ1keUYzvdmJSnMkGrvMy3_9v2eXY.%26crid%3Dlw2q2t7y%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=158;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame ADE7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvi_4qQxsvdXEDpWHBwt9h3h0goz1WZd3olY3yrijVW7CzXh6AQOGF63uSxFpdpf4yZrFek8CrS_0bg11aa6NJZT6Bg9IefcJd5Zap28zcQCbfVtFxtHJAqUyZJKYNkdg7ig3jELjCyAIqQM9SbIGNDIRixq5UV0bVwdNO7DDVRKlJnCgFa562AXvRQcPWmigcPfRWklGrNXEicUS0Lx8Go6uKTOpoUchYve6xL0P9LtFHkl9WlxWYDW1FbhCfhF7y8D9vDMr5K21I6aXngBsJqvK4VdFRywSFG6x7yWLFWaZ2nvLfwFSYXSFuX_OhKeZWB0HM6aHXoILMZnTzQYNPl2XDj7cdqlX0o8dSSQIx-tvHWH8MNkmrGog&sig=Cg0ArKJSzICHp7ooHqPlEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Sun, 05 Dec 2021 01:44:43 GMT
async_usersync
ib.adnxs.com/ Frame F92B 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
7381bc2c-2422-4f5f-bca8-c5ff63696cfe
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame F0A3 		0
836 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKXBvBMFwMAAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9KgBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC-AAwCIAwGQAwCYAxegAwGqAyoaEzcxNjcwNTY0NjIzMDgxODc4OTIqBDIwNjU6DW9ydGItbHcycTJ0N3nAA6wCyAMA2AP77xjgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMzcuMTIwLjIwNS4xODKoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAElvqQmgGIBQGYBQCgBcrt3u7J-_7nZ8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBagD-gUECAAQAJAGAJgGAKIGDjcxMjUjTllNMjo1Mjc5uAYAwQYAAAAAAADwP9AGxNAB2gYWChAh_S4BAPBSEAAYAOAGAfIGcgiKr00SbEFoRUw5azBBQUFBREFBa0NCUUVJeEpqbkJ4RG9pclVDR0pDYWtBTWdCeWdBUU02Sm9RZEk1SkNoQjFDSExWaWZLWEUBPAkBFEhnQWdRRQkMAQHwPElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoHB2F3Mndscze6Bw8IABAAGAAgADAAOLIEQADIB7_NBdIHDQkJtgRJQAEeCNoHBgknROAHAOoHAggA8Afa_xiKCAIQAA..&s=a4273c59291343a224a78bc3e47451c3186f144a&type=nv&nvt=5&jm=1003&px=436&py=226&bw=728&bh=90&sid=6752841121935943592&vd=ct~0|rr~0&sv=221&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=13830953&sw=1600&sh=1200&pw=1600&ph=7725&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
c00b9c50-c546-4204-b9d5-e90510ec3213
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=TRADEDESKV3&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&cm=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1638668682534&de=747971473107&m=0&ar=553ffc12ef5-clean&iw=5f11175&q=7&cb=0&ym=0&cu=1638668682534&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&zMoatJS=-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatDomain=bleepingcomputer.com&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&bd=www.bleepingcomputer.com&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&gw=thetradedeskv275874568748&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A512%3A512%3A0%3A602&jk=-1&jm=-1&fs=195402&na=1810697470&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:43 GMT
st
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:42 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
truncated
/ Frame 08B5 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a0c22d6d57fad45533cd5b278af7bff077c00333e779d7e4349f6cb20e533840

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
async_usersync
ib.adnxs.com/ Frame 5C5E 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
6e83c47e-2179-465f-92c8-f46b613463fd
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
truncated
/ Frame 4248 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0aaac8249462a27d0feb5a870d78db4889a4064214f9baee2ef8b4be19bb16a6

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
view
googleads4.g.doubleclick.net/pcs/ Frame 4248 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu-jQ3ZFIeP2m3YpDFD8M42HxJeteEXHQQ6ppvzWsTHi1kLmOKxxZoO86HfAzWHIv7V0LGqylkojr_JlHw6vYeUE4fLRh-_aPmKOhiNOqdRX63bt7QYsR_uOZ9BG_7jljJ7SHvO1ZtxTkJ9Xg9gga8r24Z76h_XySSE&sig=Cg0ArKJSzONI7iW_fS1SEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=596&vt=11&dtpt=595&dett=2&cstd=0&cisv=r20211201.01022&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N144601.286450AMNET/B26798917.320123302;dc_ver=81.236;dc_eid=40004001;sz=300x600;u_sd=1;gdpr=0;nel=1;dc_adk=2682109653;ord=up9pis;click=http%3A%2F%2Finsight.adsrvr.org%2Ftrack%2Fclk%3Fttd_r%3D%26imp%3Da6bb0b9f-340b-4bd4-b92a-1fc651fcbf46%26ag%3Dvpjkvsm%26sfe%3D13e39985%26sig%3DSFcAtgCvs6oXQjMfVUyTkL0llbazjCTL1iXwOgbOYrQ.%26crid%3D8334xbua%26cf%3D2716329%26fq%3D0%26t%3D1%26td_s%3Dwww.bleepingcomputer.com%26rcats%3D2dx%2Cobk%2Cjba%2Cyvb%2C3gs%26mcat%3D%26mste%3D%26mfld%3D4%26mssi%3D%26mfsi%3D%26sv%3Dappnexus%26uhow%3D164%26agsa%3D%26wp%3D%24%7BPRICE_PAID%7D%26rgz%3DH3B%26dt%3DPC%26osf%3DWindows%26os%3DWindows10%26br%3DChrome%26svpid%3D7125%26rlangs%3Den%26mlang%3D%26did%3D1267594%26rcxt%3DOther%26tmpc%3D-7.25%26vrtd%3D%26osi%3D%26osv%3D%26daid%3D%26dnr%3D0%26vpb%3D%26c%3DCgZDYW5hZGESBlF1ZWJlYxoAIghNb250cmVhbDgCUAFYAoABAIgBAZABAA..%26dur%3DCkgKIWNoYXJnZS1hbGxNb2F0Vmlld2FiaWxpdHlUcmFja2luZyIjCKX__________wESDm1vYXQtcmVwb3J0aW5nKgYIwIQ9GAw.%26durs%3Dy6VEMw%26crrelr%3D%26npt%3D%26mk%3DGoogle%26mdl%3DChrome%2520-%2520Windows%26adpt%3Danor%26ipl%3Dbleepingcomputer_300x250_300x600_160x600_Right_3%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%26pcm%3D1%26ict%3DUnknown%26said%3D7480474431045220042%26auct%3D1%26r%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F$0;xdt=0;crlt=dNFHeF70VA;gcsr=m;sttr=162;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame 4248 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssozPWsaNWuwEprmVCDtnmSCdI_0NCHAxr1C8uU4Z0xwOkmVruQWjn8reK60a9va9WMtJ5Y6aVSjNaTk36iwHP4E79o7UEjjlln_BPZCn4BwSavwroBjWK3gjFvJ7N3pJcczjKbERq1MfPqpwwOS2_-7IANuYhnc4WwjDxff19UBQh6iuzJVDgqMogqmHsMLs89Pze64wWwSTSbJZPBVCwaWBQueKvldGxBHsSd_2KwRRZPVbzXyUuyE1ea7EvkKJ6VuiGaTlVyZgtqfCFOmJX3B_aAZDUhvXNfGxqMZRE-uRyL_p8G9yE6Q5WRv2IIvXZFTSZPFEghTJrZM1sHk7vm_SgyWRH3eg_yAHIkLOiVbzO0BIv1o9Qe&sig=Cg0ArKJSzMrO6iGJmJ0iEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Sun, 05 Dec 2021 01:44:43 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 2457 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
230780
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame ADE7 		220 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5cc24dfcca7634e02dae7d2f3e8a42d09bc14b6365efc28ed26f3a362f19b934

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 91AD 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
230780
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
vevent
nym1-ib.adnxs.com/ Frame 08B5 		0
836 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKZBvBMGQMAAAMA1gAFAQiFs7CNBhDo-OOOvIOH7iwYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUI36kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9LYBmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAp5I4AKd_1vqAm1odHRwczovL3d3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbS9uZXdzL3NlY3VyaXR5L2Vtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QvgAMAiAMBkAMAmAMXoAMBqgMqGhMzMjMyNDg5NTM4MDg3MDkxMzA0KgQyMDY1Og1vcnRiLW95Ynh6aTY5wAOsAsgDANgD--8Y4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjM3LjEyMC4yMDUuMTgyqAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANoEAggB4AQB8ASN-pCaAYgFAZgFAKAFyu3e7sn7_udnwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFqAP6BQQIABAAkAYAmAYAogYONzEyNSNOWU0yOjUyNzm4BgDBBgAAAAAAAPA_0AbE0AHaBhYKEAAAAAAAAAAAAAAAAEEL8FIQABgA4AYB8gZyCIqvTRJsQWhFTDlrMEFBQUFEQUFrQ0JRRUl4SmpuQnhEb2lyVUNHSkNha0FNZ0J5Z0FRTTZKb1FkSTVKQ2hCMUNITFZpZktYRQE8CQEUSGdBZ1FFCQwBAfA8SWdCQUpBQkFKb0JBZ2dBgAcBiAcAoAcBqgcHYXcyd2xzN7oHDwgAEAAYACAAMAA4sgRAAMgHv80F0gcNCQGuDAAASUABHgjaBwYJJ0TgBwDqBwIIAPAH2v8YiggCEAA.&s=85e02bc66d50d641096562b61a8fab250b65dfda&type=nv&nvt=5&jm=1003&px=1082&py=1627&bw=300&bh=250&sid=6752841121935943592&vd=ct~0|rr~0&sv=221&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=13830953&sw=1600&sh=1200&pw=1600&ph=7725&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
82722755-0bae-4ba5-a64b-8d6f5c28b25b
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 034B 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
de69c85b-ef41-4674-bb68-7ec0506c2d09
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame 4248 		0
836 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKZBvBMGQMAAAMA1gAFAQiFs7CNBhDYlYT76J6xylcYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJ36kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9LYBmAGsAqAB2ASoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAp5I4AKiz1zqAm1odHRwczovL3d3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbS9uZXdzL3NlY3VyaXR5L2Vtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QvgAMAiAMBkAMAmAMXoAMBqgMqGhM2MzEwODg1NTQxMDk5NDA4MDg4KgQyMDY1Og1vcnRiLTgzMzR4YnVhwAOsAsgDANgD--8Y4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjM3LjEyMC4yMDUuMTgyqAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANoEAggB4AQB8ASd-pCaAYgFAZgFAKAFyu3e7sn7_udnwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFqAP6BQQIABAAkAYAmAYAogYONzEyNSNOWU0yOjUyNzm4BgDBBgAAAAAAAPA_0AbE0AHaBhYKEAAAAAAAAAAAAAAAAEEL8FIQABgA4AYB8gZyCIqvTRJsQWhFTDlrMEFBQUFEQUFrQ0JRRUl4SmpuQnhEb2lyVUNHSkNha0FNZ0J5Z0FRTTZKb1FkSTVKQ2hCMUNITFZpZktYRQE8CQEUSGdBZ1FFCQwBAfA8SWdCQUpBQkFKb0JBZ2dBgAcBiAcAoAcBqgcHYXcyd2xzN7oHDwgAEAAYACAAMAA4sgRAAMgHv80F0gcNCQGuDAAASUABHgjaBwYJJ0TgBwDqBwIIAPAH2v8YiggCEAA.&s=46d01f912a55a3d06be1c4e355e54abf02e1b782&type=nv&nvt=5&jm=1003&px=1082&py=2329&bw=300&bh=600&sid=6752841121935943592&vd=ct~0|rr~0&sv=221&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=13830953&sw=1600&sh=1200&pw=1600&ph=7725&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
2d7fae3d-c87a-453f-a431-9e7e5f6d9eae
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 09E2 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
2d0e8a7e-62e5-41e1-8954-2005bc9cc68c
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=fbeef6d0-9e2b-05d0-75e9-91e9adffb828&tv=%7Bc:vSM11j,pingTime:-10,time:2228,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuNDUgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000020000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1638668682595%7C%7C8a666fe60c44d090fb009b78565b223c%7C%7Cb4088f046bf9a570f2964ffc86d258ff%7C%7Ce6a68714d192b613b4f5f8d28e96f81b%7C%7C78a63098db532ca2343bc8fffe809565%7C%7C98412207097f34991e50fbb62197161b%7C%7Cd20797966432dba3574fcefea33235bd%7C%7C54abd9123040dcb985671a8f61cb9ea9%7C%7C1629390669,im:%7Bimprf:%7Bttecl:1458,ecd:35,tsecr:416%7D,pci:%7Btdr:1276%7D%7D,sca:%7Bspg:9ef1eab2-63bf-ab8a-ec9f-720656398207%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
x-server-name
dt10.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
vevent
nym1-ib.adnxs.com/ Frame ADE7 		0
836 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKXBvBMFwMAAAMA1gAFAQiFs7CNBhDC3ZKYocuM2nIYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9KgBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAqLPXOoCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC-AAwCIAwGQAwCYAxegAwGqAyoaEzgyNjUyODY1Nzg1NzkyMjIyMTAqBDIwNjU6DW9ydGItbHcycTJ0N3nAA6wCyAMA2AP77xjgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMzcuMTIwLjIwNS4xODKoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAElvqQmgGIBQGYBQCgBcrt3u7J-_7nZ8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBagD-gUECAAQAJAGAJgGAKIGDjcxMjUjTllNMjo1Mjc5uAYAwQYAAAAAAADwP9AGxNAB2gYWChAh_S4BAPBSEAAYAOAGAfIGcgiKr00SbEFoRUw5azBBQUFBREFBa0NCUUVJeEpqbkJ4RG9pclVDR0pDYWtBTWdCeWdBUU02Sm9RZEk1SkNoQjFDSExWaWZLWEUBPAkBFEhnQWdRRQkMAQHwPElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoHB2F3Mndscze6Bw8IABAAGAAgADAAOLIEQADIB7_NBdIHDQkJtgRJQAEeCNoHBgknROAHAOoHAggA8Afa_xiKCAIQAA..&s=93a1de81de85efca4f82177b5f94ff21e188ad05&type=nv&nvt=5&jm=1003&px=436&py=6945&bw=728&bh=90&sid=6752841121935943592&vd=ct~0|rr~0&sv=221&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=13830953&sw=1600&sh=1200&pw=1600&ph=7725&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
b72b4828-b006-4a80-9e97-c489ed940575
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 2D75 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
1f5b424b-1e72-4f9d-affc-89c1637a8d66
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
de.tynt.com/deb/ Frame 24CC
Redirect Chain
  • https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.32 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip32.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
e4dbea8f7e75ac1a84c9d0fa8e977fa17ea8670f7e7a3158e0d32c8528c86395

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires
Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy
unsafe-url
content-type
text/html
content-length
1333
date
Sun, 05 Dec 2021 01:44:43 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires
Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy
unsafe-url
content-length
0
date
Sun, 05 Dec 2021 01:44:43 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
showad.js
ads.pubmatic.com/AdServer/js/ Frame 69CD 		38 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e2cdec10db9a0a224e9f5e49b6f004c5426564fb8d857ad3df480e9c916bafe6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

last-modified
Tue, 19 Oct 2021 10:00:01 GMT
etag
"1302647-96ae-5ceb1b98ba7c4"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
13882
content-type
text/html; charset=UTF-8
cache-control
public, max-age=28832
expires
Sun, 05 Dec 2021 09:45:15 GMT
date
Sun, 05 Dec 2021 01:44:43 GMT
vary
Accept-Encoding
ixmatch.html
js-sec.indexww.com/um/ Frame 14D9 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1151
Date
Sun, 05 Dec 2021 01:44:43 GMT
Connection
keep-alive
checksync.php
contextual.media.net/ Frame 75A8 		32 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c39238598cc03d4fbaab44e7f0b3d4552f8c2617e0203cf6c5f74ce5ada647a9
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

server
Apache
content-type
text/html; charset=UTF-8
x-mnet-hl2
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=70357
expires
Sun, 05 Dec 2021 21:17:20 GMT
date
Sun, 05 Dec 2021 01:44:43 GMT
content-length
11108
showad.js
ads.pubmatic.com/AdServer/js/ Frame 3938 		38 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e2cdec10db9a0a224e9f5e49b6f004c5426564fb8d857ad3df480e9c916bafe6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

last-modified
Tue, 19 Oct 2021 10:00:01 GMT
etag
"1302647-96ae-5ceb1b98ba7c4"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
13882
content-type
text/html; charset=UTF-8
cache-control
public, max-age=28832
expires
Sun, 05 Dec 2021 09:45:15 GMT
date
Sun, 05 Dec 2021 01:44:43 GMT
vary
Accept-Encoding
check.html
biddr.brealtime.com/ Frame BC76 		926 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://biddr.brealtime.com/check.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.17.119.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Date
Sun, 05 Dec 2021 01:44:43 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
x-amz-id-2
m/iP8HNMbhF4060df/qdHjSXRhe5mH/wL0uhFM/VUNQ5NRd3/WDQsRrAhyXS3rDOvDdamw1oRcc=
x-amz-request-id
834KF6H61TQ1VB4K
Last-Modified
Tue, 08 Sep 2020 13:51:51 GMT
CF-Cache-Status
HIT
Age
1650
Expires
Sun, 05 Dec 2021 01:45:43 GMT
Cache-Control
public, max-age=60
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
6b8997493aff7144-YUL
Content-Encoding
gzip
sync
eb2.3lift.com/ Frame 33EB 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
3397516373d30834077a14b7b0d87c05c1b23dd270c331aa5a376dff4b987348

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
content-type
text/html; charset=utf-8
content-length
466
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate
pd
us-u.openx.net/w/1.0/ Frame D570 		1 KB
688 B 		Document
General
Check archive.org
Download Go to
Full URL
https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
5754c7737efcd4a8f067c11d2fb94902c5c956bbad9f157c5d116883af9d252a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 05 Dec 2021 01:44:43 GMT
content-type
text/html
content-length
669
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
sync
eb2.3lift.com/ Frame AACE 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
3397516373d30834077a14b7b0d87c05c1b23dd270c331aa5a376dff4b987348

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
content-type
text/html; charset=utf-8
content-length
466
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate
checksync.php
contextual.media.net/ Frame F7F3 		32 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c39238598cc03d4fbaab44e7f0b3d4552f8c2617e0203cf6c5f74ce5ada647a9
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

server
Apache
content-type
text/html; charset=UTF-8
x-mnet-hl2
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=70357
expires
Sun, 05 Dec 2021 21:17:20 GMT
date
Sun, 05 Dec 2021 01:44:43 GMT
content-length
11108
index.html
cdn.districtm.io/ids/ Frame D53A 		116 B
246 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
content-type
text/html
cf-ray
6b89974909b9ecfa-YUL
age
6823
last-modified
Thu, 20 May 2021 02:18:27 GMT
via
1.1 4cb1c715abfea3c2d99c87070fbe2f27.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id
MHnS9-WAg2eqTakKUSdKLMvfUIEtN2SMmRdPf0S0qZJ118yRyQMCLg==
x-amz-cf-pop
JFK51-C1
x-cache
Hit from cloudfront
vary
Accept-Encoding
server
cloudflare
content-encoding
br
ixmatch.html
js-sec.indexww.com/um/ Frame A847 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1151
Date
Sun, 05 Dec 2021 01:44:43 GMT
Connection
keep-alive
usync.html
eus.rubiconproject.com/ Frame A94D 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:44:43 GMT
Connection
keep-alive
Vary
Accept-Encoding
index.html
cdn.districtm.io/ids/ Frame 381B 		116 B
368 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
content-type
text/html
cf-ray
6b89974909baecfa-YUL
age
6823
last-modified
Thu, 20 May 2021 02:18:27 GMT
via
1.1 ab00cdb05d9e58b648b9b6b09875b196.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id
TLVOc1GM-wPGhsMkjZftdj_qYivdkbS7JLVAxmvPXqCUPdSJfujmDw==
x-amz-cf-pop
JFK51-C1
x-cache
Hit from cloudfront
vary
Accept-Encoding
server
cloudflare
content-encoding
br
pd
us-u.openx.net/w/1.0/ Frame 144D 		1 KB
688 B 		Document
General
Check archive.org
Download Go to
Full URL
https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
5754c7737efcd4a8f067c11d2fb94902c5c956bbad9f157c5d116883af9d252a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 05 Dec 2021 01:44:43 GMT
content-type
text/html
content-length
669
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
async_usersync.html
acdn.adnxs.com/dmp/ Frame F6ED 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:45 GMT
Date
Sun, 05 Dec 2021 01:44:43 GMT
Connection
keep-alive
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame C3E3 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-160-130.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Mon, 06 Dec 2021 01:44:45 GMT
Date
Sun, 05 Dec 2021 01:44:43 GMT
Connection
keep-alive
Vary
Accept-Encoding
sync
x.bidswitch.net/
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=themediagrid
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=themediagrid
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=979321821552651232&expires=30&ssp=themediagrid
43 B
220 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?dsp_id=119&user_id=979321821552651232&expires=30&ssp=themediagrid
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
18.195.106.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-106-43.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/sync?dsp_id=119&user_id=979321821552651232&expires=30&ssp=themediagrid
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame B117 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
230780
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
prebid
ib.adnxs.com/ut/v3/ Frame 3FC7 		160 B
1005 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
9be72c32fdeb906bef7631bb3e4bc907d21208cbf704c000136113d1248de7d3
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
ea8938d3-10ad-4744-b339-7a38b528d4c5
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
160
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 3FC7 		0
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
ads.adaptv.advertising.com/rtb/ Frame 3FC7 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
openrtb
ads.adaptv.advertising.com/rtb/ Frame 3FC7 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
sync
ups.analytics.yahoo.com/ups/57304/ Frame 3FC7
Redirect Chain
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ%3D
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEDco8xSPrxMTVwea5RPGrWs&google_cver=1
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDco8xSPrxMTVwea5RPGrWs&google_cver=1&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
0
160 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDco8xSPrxMTVwea5RPGrWs&google_cver=1&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
54.175.87.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-87-114.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDco8xSPrxMTVwea5RPGrWs&google_cver=1&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
date
Sun, 05 Dec 2021 01:44:44 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/55986/ Frame 3FC7
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
  • https://pixel.advertising.com/ups/55986/sync?uid=YawZhQAJhLX5VAAz&_origin=0&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YawZhQAJhLX5VAAz&_origin=0&gdpr=0&gdpr_consent=&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
0
143 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YawZhQAJhLX5VAAz&_origin=0&gdpr=0&gdpr_consent=&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
54.175.87.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-87-114.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YawZhQAJhLX5VAAz&_origin=0&gdpr=0&gdpr_consent=&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
date
Sun, 05 Dec 2021 01:44:43 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/55953/ Frame 3FC7
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&_origin=1&gdpr=0&gdpr_consent=
0
404 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55953/sync?uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&_origin=1&gdpr=0&gdpr_consent=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
54.175.87.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-87-114.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ups.analytics.yahoo.com/ups/55953/sync?uid=7de5ca57-c954-4db1-bc90-ae26323dfac5&_origin=1&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
267
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 014D 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
230780
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/ Frame 4248 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodarir&v=30&d=1&s=1&f=0.01&bgai=B9v1MihmsYdmSE5qLoPwPuNuUuAsAAAAAOAHgBAI
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8497077%2FMC_AM_IDEON_728x90_en.png&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=10&f=0&j=&t=1638668682534&de=747971473107&cu=1638668682534&m=21&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A512%3A512%3A0%3A602&as=0&ag=4&an=0&gf=4&gg=0&ix=4&ic=4&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=4&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=8&cd=0&ah=8&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=DOMSEARCH&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&ti=0&ih=1&jk=-1&jm=2&tc=0&fs=195402&na=627130275&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:43 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=44b263a8-3dc5-6d0b-919c-cf65caeccc4c&tv=%7Bc:vSM13a,pingTime:-10,time:2246,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuNDUgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000020000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1638668682595%7C%7C8a666fe60c44d090fb009b78565b223c%7C%7Cb4088f046bf9a570f2964ffc86d258ff%7C%7Ce6a68714d192b613b4f5f8d28e96f81b%7C%7C78a63098db532ca2343bc8fffe809565%7C%7C98412207097f34991e50fbb62197161b%7C%7Cd20797966432dba3574fcefea33235bd%7C%7C54abd9123040dcb985671a8f61cb9ea9%7C%7C1629390669,im:%7Bimprf:%7Bttecl:1320,ecd:33,tsecr:342%7D,pci:%7Btdr:1808%7D%7D,sca:%7Bspg:9ef1eab2-63bf-ab8a-ec9f-720656398207%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
x-server-name
dt19.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
/
insight.adsrvr.org/enduser/pie/ 		807 B
925 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/pie/?pie=20&vet=1&rtb=dD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 4B3D 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
230780
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=f3e67bff-2ad3-5ea8-e308-f3f0ed0d8a54&tv=%7Bc:vSM13V,pingTime:-10,time:2038,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ni4wLjQ2NjQuNDUgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000020000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1638668682595%7C%7C8a666fe60c44d090fb009b78565b223c%7C%7Cb4088f046bf9a570f2964ffc86d258ff%7C%7Ce6a68714d192b613b4f5f8d28e96f81b%7C%7C78a63098db532ca2343bc8fffe809565%7C%7C98412207097f34991e50fbb62197161b%7C%7Cd20797966432dba3574fcefea33235bd%7C%7C54abd9123040dcb985671a8f61cb9ea9%7C%7C1629390669,im:%7Bimprf:%7Bttecl:869,ecd:23,tsecr:81%7D,pci:%7Btdr:1652%7D%7D,sca:%7Bspg:9ef1eab2-63bf-ab8a-ec9f-720656398207%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
x-server-name
dt07.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=TRADEDESKV3&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&cm=11&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1638668682883&de=968877376972&m=0&ar=553ffc12ef5-clean&iw=5f11175&q=15&cb=0&ym=0&cu=1638668682883&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&zMoatJS=-&zMoatCachebuster=422539&zMoatCreative=8334xbua&zMoatDealID=1267594&zMoatDomain=bleepingcomputer.com&zMoatImpressionId=a6bb0b9f-340b-4bd4-b92a-1fc651fcbf46&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD1hNmJiMGI5Zi0zNDBiLTRiZDQtYjkyYS0xZmM2NTFmY2JmNDYmY3JpZD04MzM0eGJ1YSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02MzEwODg1NTQxMDk5NDA4MDg4JndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zL2JsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMyZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&bd=www.bleepingcomputer.com&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&gw=thetradedeskv275874568748&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A512%3A512%3A0%3A602&jk=-1&jm=-1&fs=195402&na=1675677891&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:43 GMT
usync.js
eus.rubiconproject.com/ Frame A94D 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
ea69b75b81243d7429f2762349a7b95e0fc43ca337db14df218371e656286357

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17694
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:38 GMT
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 3FC7 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668682700&gdpr=&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
662c242e123bfa13a1554f93988a23846fbcd5aa988580427b70999a137a49db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
server
adaptv/1.0
content-type
text/xml
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
955
expires
0
xuid
eb2.3lift.com/ Frame AACE
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
209
xuid
eb2.3lift.com/ Frame AACE
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame AACE
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
/
p.adsymptotic.com/d/px/ Frame AACE
Redirect Chain
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent=
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent=&cookiesTest=true
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=e8cc338...
43 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=e8cc3384036825b3d0d76f98b28a130a
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
104.18.101.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6b89974eab3fca4f-YUL
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=e8cc3384036825b3d0d76f98b28a130a
date
Sun, 05 Dec 2021 01:44:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6b89974dba88ca4f-YUL
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
xuid
eb2.3lift.com/ Frame AACE
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/5223479661490903678?gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
xuid
eb2.3lift.com/ Frame AACE
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=5223479661490903678&gdpr=0&gdpr_consent=
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtriplelift%26bsw_par...
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=6a9099fe149943558409bf11cf581e18&ssp=triplelift&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&consent=&gdpr_pd=&expires=7
  • https://eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
//eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=0&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
c.gif
c.bing.com/ Frame AACE 		42 B
668 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=5223479661490903678&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
etag
"c4ddde5e69d2d71:0"
last-modified
Fri, 05 Nov 2021 17:20:03 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 66C96D790FCB43059CEBF751C3F9D66C Ref B: YMQ01EDGE0817 Ref C: 2021-12-05T01:44:44Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame AACE 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=5223479661490903678
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
xuid
eb2.3lift.com/ Frame AACE
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=clov18HnwPssF8vs3A5I&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5MNWG65RRHBEG4...
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=clov18HnwPssF8vs3A5I
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=clov18HnwPssF8vs3A5I
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
P3p
CP="We do not support P3P header."
Location
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=clov18HnwPssF8vs3A5I
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
115
Expires
Thu, 01 Dec 1994 16:00:00 GMT
xuid
eb2.3lift.com/ Frame AACE
Redirect Chain
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
xuid
eb2.3lift.com/ Frame 33EB
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=7de5ca57-c954-4db1-bc90-ae26323dfac5&dongle=0cfd
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
209
xuid
eb2.3lift.com/ Frame 33EB
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFZwX2m9auZFkWGUn53hI5k&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 33EB
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H3
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NTIyMzQ3OTY2MTQ5MDkwMzY3OA%3D%3D
date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
/
p.adsymptotic.com/d/px/ Frame 33EB
Redirect Chain
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent=
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=5223479661490903678&dbredirect=true&gdpr=0&consent=&cookiesTest=true
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=0381553...
43 B
142 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=03815539ed5b596b1210606f155e6e8e
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
104.18.101.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6b89974eab3eca4f-YUL
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=c470db56-01bf-493f-970b-464e03c90b90&_noobservation=1&_expected_cookie=03815539ed5b596b1210606f155e6e8e
date
Sun, 05 Dec 2021 01:44:44 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6b89974dba8aca4f-YUL
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
xuid
eb2.3lift.com/ Frame 33EB
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/5223479661490903678?gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-U81O9mtE2oQRD0CLPQleiR1fMqKMlgAI._85N3HRQw--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
xuid
eb2.3lift.com/ Frame 33EB
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=5223479661490903678&gdpr=0&gdpr_consent=
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=triplelift
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=4764934967218434204&ssp=triplelift
  • https://eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
//eb2.3lift.com/xuid?mid=2409&xuid=e844459d-39b0-402c-bf5a-7640e7a8c718&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
c.gif
c.bing.com/ Frame 33EB 		42 B
262 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=5223479661490903678&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
etag
"c4ddde5e69d2d71:0"
last-modified
Fri, 05 Nov 2021 17:20:03 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 633302D7EB4A48D1913AF644A414A7C1 Ref B: YMQ01EDGE0817 Ref C: 2021-12-05T01:44:44Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame 33EB 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=5223479661490903678
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
xuid
eb2.3lift.com/ Frame 33EB
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=Fwkk8MZfi77mYekkQ5yQ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5IZ3WW2ZYJVNGM...
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fwkk8MZfi77mYekkQ5yQ
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fwkk8MZfi77mYekkQ5yQ
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
P3p
CP="We do not support P3P header."
Location
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fwkk8MZfi77mYekkQ5yQ
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
115
Expires
Thu, 01 Dec 1994 16:00:00 GMT
xuid
eb2.3lift.com/ Frame 33EB
Redirect Chain
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://eb2.3lift.com/xuid?mid=4771&xuid=7864110075816986117&dongle=d407
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
sync
ups.analytics.yahoo.com/ups/58294/ Frame 144D
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID}
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
0
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Server
54.175.87.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-87-114.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
date
Sun, 05 Dec 2021 01:44:44 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
396846.gif
idsync.rlcdn.com/ Frame 144D
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
  • https://id.rlcdn.com/464246.gif?partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
sd
us-u.openx.net/w/1.0/ Frame 144D
Redirect Chain
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
5b1cb1b6-baa3-4699-a75f-74dc5d1441dc
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 144D 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=12a9d746-5d75-8fd4-bc6b-6c0828b7282e
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
TC3NR3DMYZSK6CYY3EXR
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 144D
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
sd
us-u.openx.net/w/1.0/ Frame 144D
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638668684.076395,VS0,VE0
x-served-by
cache-yul12823-YUL
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
deb8cd7f-d173-a667-4db2-f86abfd32e87
pr-bh.ybp.yahoo.com/sync/openx/ Frame 144D 		43 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/deb8cd7f-d173-a667-4db2-f86abfd32e87?gdpr=0
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
us-u.openx.net/w/1.0/ Frame 144D
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
43 B
62 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
293
pixel
cm.g.doubleclick.net/ Frame 144D 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NjYxMDc4ZjEtODhhOC02YThhLTY5ODUtYjQyNjhhNjYyZGFl
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 144D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
ups.analytics.yahoo.com/ups/58294/ Frame D570
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID}
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Server
54.175.87.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-87-114.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=64bb28b2-99b5-0e67-2f42-2f95d72717a7&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
date
Sun, 05 Dec 2021 01:44:44 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
362358.gif
idsync.rlcdn.com/ Frame D570
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
  • https://id.rlcdn.com/464246.gif?partner_uid=1fb9d45d-8c98-024e-231c-6e6c791f8216
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFe1o70PLgZZofw4kbnUoCU&google_cver=1
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFe1o70PLgZZofw4kbnUoCU&google_cver=1
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFe1o70PLgZZofw4kbnUoCU&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
289
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame D570
Redirect Chain
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
46fc917e-2668-4dc1-a0e4-5c3f4f755eed
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://us-u.openx.net/w/1.0/sd?id=537072399&val=8987304192775495297
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame D570 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=12a9d746-5d75-8fd4-bc6b-6c0828b7282e
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
38P3A41RHDT7NFXJ2Y30
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame D570
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=7864110075816986117&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
sd
us-u.openx.net/w/1.0/ Frame D570
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638668684.076543,VS0,VE0
x-served-by
cache-yul12823-YUL
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YawZhQAJhLX5VAAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
deb8cd7f-d173-a667-4db2-f86abfd32e87
pr-bh.ybp.yahoo.com/sync/openx/ Frame D570 		43 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/deb8cd7f-d173-a667-4db2-f86abfd32e87?gdpr=0
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
us-u.openx.net/w/1.0/ Frame D570
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
43 B
62 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=7de5ca57-c954-4db1-bc90-ae26323dfac5&ttd_puid=4a7fab3b-41df-342e-7c65-ee9f4084e3ce
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
293
pixel
cm.g.doubleclick.net/ Frame D570 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NjYxMDc4ZjEtODhhOC02YThhLTY5ODUtYjQyNjhhNjYyZGFl
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s35-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame D570
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJTF3bhSudegCLkxi9K5cMo&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
idsync.d5cb6b96.js
cdn.districtm.io/ids/ Frame 381B 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/ids/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 fba70d1e4c74a3621a7d03b3d021b4dc.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
82397
cf-polished
origSize=3302
x-cache
Miss from cloudfront
cf-bgj
minify
content-encoding
br
last-modified
Thu, 20 May 2021 02:18:27 GMT
server
cloudflare
etag
W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=172800
x-amz-cf-pop
EWR52-C4
cf-ray
6b89974b2c4fecfa-YUL
x-amz-cf-id
grPGiWniH68bfTtn_MAV7TZgFVtqyKFXbidN-Zh6RPPqvpzkLyNSHw==
expires
Tue, 07 Dec 2021 01:44:44 GMT
idsync.d5cb6b96.js
cdn.districtm.io/ids/ Frame D53A 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/ids/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 fba70d1e4c74a3621a7d03b3d021b4dc.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
82397
cf-polished
origSize=3302
x-cache
Miss from cloudfront
cf-bgj
minify
content-encoding
br
last-modified
Thu, 20 May 2021 02:18:27 GMT
server
cloudflare
etag
W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=172800
x-amz-cf-pop
EWR52-C4
cf-ray
6b89974b2c50ecfa-YUL
x-amz-cf-id
grPGiWniH68bfTtn_MAV7TZgFVtqyKFXbidN-Zh6RPPqvpzkLyNSHw==
expires
Tue, 07 Dec 2021 01:44:44 GMT
usermatch
ssum-sec.casalemedia.com/ Frame 8EDC 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f126db35d376ca52cb574fb35418df46562bcfd2cee5e8deab879a1d27e026d3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://js-sec.indexww.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
46|3|88|206|241|40|111|73
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1721
Expires
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Connection
keep-alive
PugMaster
image6.pubmatic.com/AdServer/ Frame 69CD 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=48819813&p=156696&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
eeb973b10d01961e3eaaecf2791e13e4ea0c6c0f0241346b81248ee3505e4432

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:42 GMT
content-type
text/html; charset=UTF-8
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
async_usersync
ib.adnxs.com/ Frame F6ED 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
fffd8cc1-0d32-4deb-bb1e-c4d504538db7
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usermatch
ssum-sec.casalemedia.com/ Frame ECA1 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
fc182daf225bb54bf268219eb3884cf5494f5f304337c9c1b9a9dfcb86d16fb7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://js-sec.indexww.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
46|3|206|88|73|196|131|152
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1802
Expires
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Connection
keep-alive
async_usersync
ib.adnxs.com/ Frame C3E3 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
d31ce0ba-44c2-4fa9-80a7-a08b8e1d1765
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pubcid.php
hbx.media.net/ Frame F7F3 		57 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hbx.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
max-age=1800
content-length
18543
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 02:14:44 GMT
sync
gum.criteo.com/ Frame F7F3 		61 B
372 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Sun, 05 Dec 2021 01:44:43 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
1263
content-length
175
expires
60
cksync.html
contextual.media.net/ Frame 5FAB
Redirect Chain
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Drkt%26refUrl%3D%26vid%3D866868411128167028373974040...
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841112816702837397404000V10&ovsid=979321821552651232
219 B
648 B 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841112816702837397404000V10&ovsid=979321821552651232
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/

Response headers

server
Apache
content-length
219
content-type
text/html;charset=UTF-8
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841112816702837397404000V10&ovsid=979321821552651232
Content-Length
0
Server
Jetty(9.3.29.v20201019)
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dcon%26refUrl...
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=4e177ebba12a122e&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841112816702837397404000V10&ovsid=AAAGdRmaSRiJfwNLCneoAAAAAAA&expiration=1638755084&is_secure=true
45 B
458 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841112816702837397404000V10&ovsid=AAAGdRmaSRiJfwNLCneoAAAAAAA&expiration=1638755084&is_secure=true
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841112816702837397404000V10&ovsid=AAAGdRmaSRiJfwNLCneoAAAAAAA&expiration=1638755084&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dmma%26refUrl%3D%26vid%3D866868411128167028373974...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841112816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841112816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
MT3 4133 baa842e master iad-pixel-x13 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841112816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:43 GMT
cksync
cs.media.net/ Frame F7F3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwMjgzNzM5NzQwNDAwMFYxMA%3D%3D&google_sc=1
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
45 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86686841112816702837397...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841112816702837397404000V10&ovsid=IoqlAHf41MTGzX5
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841112816702837397404000V10&ovsid=IoqlAHf41MTGzX5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-0c4ee88f294942f85@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841112816702837397404000V10&ovsid=IoqlAHf41MTGzX5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
  • https://widget.us.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bcd0c355-6644-4105-a88b-337907a30096
45 B
614 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bcd0c355-6644-4105-a88b-337907a30096
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
server
Kestrel
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bcd0c355-6644-4105-a88b-337907a30096
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1347328
content-length
0
expires
Sun, 05 Dec 2021 00:00:00 GMT
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dmedianet%26bsw_param...
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=6a9099fe149943558409bf11cf581e18&ssp=medianet&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&consent=&gdpr_pd=1&expires=7
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&gdpr_consent=&gdpr_pd=1
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&gdpr_consent=&gdpr_pd=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Location
//contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=0&gdpr_consent=&gdpr_pd=1
Date
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dzem%26refUrl%3D%26vid%3D86686841112816702837397404...
  • https://stags.bluekai.com/site/23178?id=9-3_5eCUoYmiirPC7-_j&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPJZFUZV6NLFINKW6WLNNFUXEUCDG4WV6...
  • https://contextual.media.net/cksync.php?cs=8&ovsid=9-3_5eCUoYmiirPC7-_j&refUrl=&type=zem&vid=86686841112816702837397404000V10&vsid=2816702837397404000V10
45 B
453 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&ovsid=9-3_5eCUoYmiirPC7-_j&refUrl=&type=zem&vid=86686841112816702837397404000V10&vsid=2816702837397404000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
P3p
CP="We do not support P3P header."
Location
https://contextual.media.net/cksync.php?cs=8&ovsid=9-3_5eCUoYmiirPC7-_j&refUrl=&type=zem&vid=86686841112816702837397404000V10&vsid=2816702837397404000V10
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
196
Expires
Thu, 01 Dec 1994 16:00:00 GMT
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816702837397404000V10
  • https://contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

location
//contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
via
1.1 google
710489.gif
id.rlcdn.com/ Frame F7F3 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/710489.gif
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
cksync
cs.media.net/ Frame F7F3
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
199
cksync.php
contextual.media.net/ Frame F7F3
Redirect Chain
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Damb%26refUrl%3D%26vid%3D86686841112816702837397404000V10%26ov...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841112816702837397404000V10&ovsid=7864110075816986117
45 B
451 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841112816702837397404000V10&ovsid=7864110075816986117
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841112816702837397404000V10&ovsid=7864110075816986117
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8497077%2FMC_AM_IDEON_300x600_en.png&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=11&f=0&j=&t=1638668682883&de=968877376972&cu=1638668682883&m=25&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A512%3A512%3A0%3A602&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=6&cd=0&ah=6&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=422539&zMoatCreative=8334xbua&zMoatDealID=1267594&zMoatImpressionId=a6bb0b9f-340b-4bd4-b92a-1fc651fcbf46&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD1hNmJiMGI5Zi0zNDBiLTRiZDQtYjkyYS0xZmM2NTFmY2JmNDYmY3JpZD04MzM0eGJ1YSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02MzEwODg1NTQxMDk5NDA4MDg4JndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zL2JsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMyZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=DOMSEARCH&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&ti=0&ih=1&jk=-1&jm=1&tc=0&fs=195402&na=628498291&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
pubcid.php
hbx.media.net/ Frame 75A8 		57 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hbx.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
max-age=1800
content-length
18543
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 02:14:44 GMT
sync
gum.criteo.com/ Frame 75A8 		61 B
372 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Sun, 05 Dec 2021 01:44:43 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
1503
content-length
175
expires
60
cksync
cs.media.net/ Frame 75A8
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwMjgzNzM5NzQwNDAwMFYxMA%3D%3D&google_sc=1
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
45 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEK-ZOrDvhWq6J9C3ATpVbTg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.html
contextual.media.net/ Frame E72F
Redirect Chain
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Drkt%26refUrl%3D%26vid%3D866868415228167028373974040...
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841522816702837397404000V10&ovsid=979321821552651232
219 B
648 B 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841522816702837397404000V10&ovsid=979321821552651232
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/

Response headers

server
Apache
content-length
219
content-type
text/html;charset=UTF-8
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://contextual.media.net/cksync.html?cs=8&vsid=2816702837397404000V10&type=rkt&refUrl=&vid=86686841522816702837397404000V10&ovsid=979321821552651232
Content-Length
0
Server
Jetty(9.3.29.v20201019)
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
  • https://widget.us.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=590dcce8-2386-42d6-b790-0496b3dda96c
45 B
614 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=590dcce8-2386-42d6-b790-0496b3dda96c
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
Kestrel
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=590dcce8-2386-42d6-b790-0496b3dda96c
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
2431638
content-length
0
expires
Sun, 05 Dec 2021 00:00:00 GMT
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=medianet&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718&google_hm=ZTg0NDQ1OWQtMzliMC00MDJjLWJmNWEtNzY0MGU3YThjNzE4
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEEbTvjSvONRhZIc_lPCLfA4&google_cver=1&ssp=medianet&bsw_param=e844459d-39b0-402c-bf5a-7640e7a8c718
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Location
//contextual.media.net/cksync.php?cs=1&type=bs&ovsid=e844459d-39b0-402c-bf5a-7640e7a8c718&gdpr=&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816702837397404000V10
  • https://contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

location
//contextual.media.net/cksync.php?type=mf&ovsid=445d1fc1-46d4-494d-842f-cfe15cd6e197&cs=1
date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
via
1.1 google
710489.gif
id.rlcdn.com/ Frame 75A8 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/710489.gif
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
cksync
cs.media.net/ Frame 75A8
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=7de5ca57-c954-4db1-bc90-ae26323dfac5
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
199
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dcon%26refUrl...
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=1b1107c35722122d&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841522816702837397404000V10&ovsid=AAAGdc-Aay3uBQN1cTHvAAAAAAA&expiration=1638755084&is_secure=true
45 B
458 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841522816702837397404000V10&ovsid=AAAGdc-Aay3uBQN1cTHvAAAAAAA&expiration=1638755084&is_secure=true
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=con&refUrl=&vid=86686841522816702837397404000V10&ovsid=AAAGdc-Aay3uBQN1cTHvAAAAAAA&expiration=1638755084&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dmma%26refUrl%3D%26vid%3D866868415228167028373974...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841522816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841522816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
MT3 4133 baa842e master iad-pixel-x25 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=mma&refUrl=&vid=86686841522816702837397404000V10&ovsid=badc61ac-1985-4000-9788-0d2b1d82255b
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:43 GMT
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86686841522816702837397...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841522816702837397404000V10&ovsid=IoqlAHf41MTGzX5
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841522816702837397404000V10&ovsid=IoqlAHf41MTGzX5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:43 GMT
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-04cde2ff0dc503f40@us-east-1b@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=dxu&refUrl=&vid=86686841522816702837397404000V10&ovsid=IoqlAHf41MTGzX5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Dzem%26refUrl%3D%26vid%3D86686841522816702837397404...
  • https://stags.bluekai.com/site/23178?id=trvwnD5JptIAO-iXxRvu&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLUOJ3HO3SEGVFHA5CJIFHS22KYPBJHM...
  • https://contextual.media.net/cksync.php?cs=8&ovsid=trvwnD5JptIAO-iXxRvu&refUrl=&type=zem&vid=86686841522816702837397404000V10&vsid=2816702837397404000V10
45 B
453 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&ovsid=trvwnD5JptIAO-iXxRvu&refUrl=&type=zem&vid=86686841522816702837397404000V10&vsid=2816702837397404000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
P3p
CP="We do not support P3P header."
Location
https://contextual.media.net/cksync.php?cs=8&ovsid=trvwnD5JptIAO-iXxRvu&refUrl=&type=zem&vid=86686841522816702837397404000V10&vsid=2816702837397404000V10
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
196
Expires
Thu, 01 Dec 1994 16:00:00 GMT
cksync.php
contextual.media.net/ Frame 75A8
Redirect Chain
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816702837397404000V10%26type%3Damb%26refUrl%3D%26vid%3D86686841522816702837397404000V10%26ov...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841522816702837397404000V10&ovsid=7864110075816986117
45 B
451 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841522816702837397404000V10&ovsid=7864110075816986117
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:44:44 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

location
https://contextual.media.net/cksync.php?cs=8&vsid=2816702837397404000V10&type=amb&refUrl=&vid=86686841522816702837397404000V10&ovsid=7864110075816986117
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
o2shim
acds.prod.vidible.tv/ Frame 8210 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=6afacd1e-1950-4d89-a104-277b55ddc0b4&pblob=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.207.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-207-71.compute-1.amazonaws.com
Software
/
Resource Hash
d42995148a2fc412f49e4411183636e9192a226fb4c3912e627655db7977284a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-encoding
gzip
access-control-max-age
3600
access-control-allow-methods
POST, GET, HEAD, PUT, PATCH, DELETE
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-headers
content-length
6641
activeview
pagead2.googlesyndication.com/pcs/ Frame F0A3 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvjhI4OnABr-VloV8pvJFhOaUqVoCOuWuqSYaGkFP173P-WUq4Ha1CDfTk23OYj2Lt3lHbGBP8z0j1R5imSu5JFX1votM1ToLo&sig=Cg0ArKJSzIRBOKZL3KONEAE&id=lidar2&mcvt=1130&p=0,0,90,728&mtos=1130,1130,1130,1130,1130&tos=1130,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=32&adk=3492570197&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638668679282&rpt=3752&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame F0A3 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst8WtprIhjiR0TIRf76cbHBV5d_Rk4dmob9DjgZflRCoUaNo8nDWizwbv3MbnTpWHzZ-0bL7di7MeAxfLrNzGNOGjfZGXgxlZWYIhG8f84jCcD1AjT_&sig=Cg0ArKJSzObfF5fOsVSIEAE&id=lidar2&mcvt=1132&p=226,436,316,1164&mtos=1132,1132,1132,1132,1132&tos=1132,0,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=960084856&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638668679282&rpt=3748&isd=0&lsd=0&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
pagead2.googlesyndication.com/bg/ Frame 2457 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e127dce391c5b30b9f8027fc7d0097db662ce9c6af8eef63207ffe4a1432b55d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
383038
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13379
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 30 Nov 2022 15:20:46 GMT
4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
pagead2.googlesyndication.com/bg/ Frame 91AD 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e127dce391c5b30b9f8027fc7d0097db662ce9c6af8eef63207ffe4a1432b55d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
383038
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13379
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 30 Nov 2022 15:20:46 GMT
usync.html
eus.rubiconproject.com/ Frame B142
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
  • https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
about:blank

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:44:44 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Date
Sun, 05 Dec 2021 01:44:44 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
match
cms-xch-chicago.33across.com/ Frame 24CC
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=93&user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
  • https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3...
  • https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
  • https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

location
https://cms-xch-chicago.33across.com:443/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=e844459d-39b0-402c-bf5a-7640e7a8c718
date
Sun, 05 Dec 2021 01:44:45 GMT
server
awselb/2.0
content-length
134
content-type
text/html
match
cms-xch-chicago.33across.com/ Frame 24CC
Redirect Chain
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1638668683884.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fc...
  • https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
  • https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
MT3 4133 baa842e master iad-pixel-x1 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:43 GMT
match
cms-xch-chicago.33across.com/ Frame 24CC
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
  • https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-06Ws90BE2uHYKFpbS0U.YFj1h.ATYhTM~A
  • https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-06Ws90BE2uHYKFpbS0U.YFj1h.ATYhTM%7EA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-06Ws90BE2uHYKFpbS0U.YFj1h.ATYhTM%7EA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
unsafe-url
server
33XP002
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-06Ws90BE2uHYKFpbS0U.YFj1h.ATYhTM%7EA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
cms-xch-chicago.33across.com/ Frame 24CC
Redirect Chain
  • https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
  • https://33across-match.dotomi.com/match/bounce/current?DotomiTest=21ae8a656132122e&is_secure=true&networkId=78390&version=1&us_privacy=
  • https://ssc-cms.33across.com/ps?xi=64&xu=AAAGdipzeeAG0AMRLIkoAAAAAAA&expiration=1638755084&is_secure=true&us_privacy=
  • https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdipzeeAG0AMRLIkoAAAAAAA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdipzeeAG0AMRLIkoAAAAAAA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
referrer-policy
unsafe-url
server
33XP001
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdipzeeAG0AMRLIkoAAAAAAA&ts=1638668684&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
cms-xch-chicago.33across.com/ Frame 24CC
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
  • https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1641260684%26external_user_id%3D7de5ca57-c954-4db1-bc90-ae26323dfac5
  • https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641260684&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5
68 B
213 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641260684&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:43 GMT
referrer-policy
unsafe-url
server
33XP005
x-33x-status
40000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641260684&external_user_id=7de5ca57-c954-4db1-bc90-ae26323dfac5
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9ef1eab2-63bf-ab8a-ec9f-720656398207&tv=%7Bc:vSM1bG,pingTime:1,time:2942,type:p,im:%7Bpci:%7Btdr:1773%7D%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:38%7D,%7Bpiv:100,vs:i,r:,t:1896%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1046,o:1896,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1890~0,0~100%5D,as:%5B1890~728.90%5D%7D%7D,%7Bsl:i,t:1896,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1046~100%5D,as:%5B1046~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:true,e:,tt:rjss,dtt:610,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n*.877959-58497149%7C1o.877959-58497149%7C1p.877959-58497151%7C1q.877959-58497147%7C1r.877959-58497149%7C1s,idMap:1n*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-server-name
dt16.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9ef1eab2-63bf-ab8a-ec9f-720656398207&tv=%7Bc:vSM1bH,pingTime:1,time:2943,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:38%7D,%7Bpiv:100,vs:i,r:,t:1896%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1047,o:1896,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1890~0,0~100%5D,as:%5B1890~728.90%5D%7D%7D,%7Bsl:i,t:1896,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1047~100%5D,as:%5B1047~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:true,e:,tt:rjss,dtt:610,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n*.877959-58497149%7C1o.877959-58497149%7C1p.877959-58497151%7C1q.877959-58497147%7C1r.877959-58497149%7C1s,idMap:1n*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-server-name
dt17.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
buyers
dmx.districtm.io/s/v1/ Frame D53A 		462 B
712 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/buyers
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
77f28dee1711e11fef9960073fe4da9c9a442931f62711ee7ec7fa22fde30edd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
DELETE, GET, OPTIONS, POST
content-type
application/json
access-control-allow-origin
https://cdn.districtm.io
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b89974ccde1ecfa-YUL
access-control-allow-headers
Origin, Content-Type
buyers
dmx.districtm.io/s/v1/ Frame 381B 		462 B
625 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/buyers
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dd7bcaf63e84ebe38399409f74d3d9273fb3044e436bb5d8c2918531930a9c3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
DELETE, GET, OPTIONS, POST
content-type
application/json
access-control-allow-origin
https://cdn.districtm.io
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b89974ccde5ecfa-YUL
access-control-allow-headers
Origin, Content-Type
place
freestar-tagan.adlightning.com/ Frame 4248 		0
426 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=eyJzaXRlSWQiOiJmcmVlc3RhciIsInVybCI6Imh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC8iLCJhZFVuaXQiOiIvMTUxODQxODYvYmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDg1OTQzODgwNiIsImNhbXBhaWduSWQiOiIyNjgwODI5NDc4IiwiY3JlYXRpdmVJZCI6IjEzODMwNzU0MzM2OSIsImxpbmVpdGVtSWQiOiI1MzM0MDM3ODg3IiwiYWRTZXJ2ZXIiOiJkZnAiLCJwcmViaWRDcmVhdGl2ZUlkIjoiMzIzMjM5MTk3IiwicHJlYmlkQmlkZGVyIjoiYXBwbmV4dXMiLCJwcmViaWQiOjF9LCJ3aWR0aCI6MzAwLCJoZWlnaHQiOjI1MCwid3YiOiIxLjAuMCs1YTk5ZTUwIiwiYnYiOiIxLjAuMCs1YTk5ZTUwIiwidGFnTWFya3VwIjoiPGh0bWw%2BPGhlYWQ%2BPG1ldGEgZGF0YS1qYz1cIjgyXCIgZGF0YS1qYy12ZXJzaW9uPVwicjIwMjExMjAxXCI%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJcIiBzcmM9XCIvL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc29kYXIvVUZZd1d3bXQuanNcIj48L3NjcmlwdD48c2NyaXB0IGRhdGEtamM9XCI4NlwiIHNyYz1cImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL3IyMDIxMTIwMS9yMjAxMTA5MTQvZWxlbWVudHMvaHRtbC9vbXJocC5qc1wiIGRhdGEtamMtdmVyc2lvbj1cInIyMDIxMTIwMVwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vZnJlZXN0YXIvYmwtZjgyMWE5NS1mY2U5ZWM2MC5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL2ZyZWVzdGFyL2ItNWE5OWU1MC0wZWY5MjVlMS5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD48c2NyaXB0PndpbmRvd1tcIjIyMTc0NDI0X2ZyZWVzdGFyXCJdID0gd2luZG93W1wiMjIxNzQ0MjRfZnJlZXN0YXJcIl0gfHwge307d2luZG93W1wiMjIxNzQ0MjRfZnJlZXN0YXJcIl0udGFnRGV0YWlscyA9IHdpbmRvd1tcIjIyMTc0NDI0X2ZyZWVzdGFyXCJdLnRhZ0RldGFpbHMgfHwge1wic2l0ZUlkXCI6XCJmcmVlc3RhclwiLFwid3ZcIjpcIjEuMC4wKzVhOTllNTBcIixcInRvcERvbWFpblwiOlwiaHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vbmV3cy9zZWN1cml0eS9lbW90ZXQtbWFsd2FyZS1pcy1iYWNrLWFuZC1yZWJ1aWxkaW5nLWl0cy1ib3RuZXQtdmlhLXRyaWNrYm90L1wiLFwiY3VycmVudFRhZ0lkXCI6XCJhZGx0YWdfa3dzbDB0ajdfSlAzcE5ieWc5V1wiLFwiYXVcIjpcIi8xNTE4NDE4Ni9ibGVlcGluZ2NvbXB1dGVyXzMwMHgyNTBfMzAweDYwMF8xNjB4NjAwX1JpZ2h0XzNfMFwiLFwic2xvdEVsZW1lbnRJZFwiOlwiYmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zXCIsXCJhZFNlcnZlckRldGFpbHNcIjp7XCJhZHZlcnRpc2VySWRcIjpcIjQ4NTk0Mzg4MDZcIixcImNhbXBhaWduSWRcIjpcIjI2ODA4Mjk0NzhcIixcImNyZWF0aXZlSWRcIjpcIjEzODMwNzU0MzM2OVwiLFwibGluZWl0ZW1JZFwiOlwiNTMzNDAzNzg4N1wiLFwiYWRTZXJ2ZXJcIjpcImRmcFwifSxcIndcIjozMDAsXCJoXCI6MjUwfTt3aW5kb3cuYmxvY2tlciAmJiBibG9ja2VyKFwiMjIxNzQ0MjRfZnJlZXN0YXJcIiwgXCI8IS0tQURMX1dSQVBQRUQtLT5cIiwgZmFsc2UsIHdpbmRvdywge1wicmVmcmVzaE1lc3NhZ2VcIjpcInRydWVcIn0pOzwvc2NyaXB0PjxzY3JpcHQ%2BdmFyIGluRGFwSUY9dHJ1ZSxpbkdwdElGPXRydWU7PC9zY3JpcHQ%2BPG1ldGEgaHR0cC1lcXVpdj1cIm9yaWdpbi10cmlhbFwiIGNvbnRlbnQ9XCJBNC9IdGVybjJ1ZE45dzN5Sks5UWdXUXhRRnJ1eE9Yc1hMN2NXNjBEeUNsMEVaRkdDU21lL0ozM1EvV3pGN2JCa1Z2aEVXRGxjQmlVeVphaW01Q3BGUXdBQUFDY2V5SnZjbWxuYVc0aU9pSm9kSFJ3Y3pvdkwyZHZiMmRzWlhSaFozTmxjblpwWTJWekxtTnZiVG8wTkRNaUxDSm1aV0YwZFhKbElqb2lRMjl1ZG1WeWMybHZiazFsWVhOMWNtVnRaVzUwSWl3aVpYaHdhWEo1SWpveE5qUXpNVFUxTVRrNUxDSnBjMU4xWW1SdmJXRnBiaUk2ZEhKMVpTd2lhWE5VYUdseVpGQmhjblI1SWpwMGNuVmxMQ0oxYzJGblpTSTZJbk4xWW5ObGRDSjlcIj48L2hlYWQ%2BPGJvZHkgbGVmdG1hcmdpbj1cIjBcIiB0b3BtYXJnaW49XCIwXCIgbWFyZ2lud2lkdGg9XCIwXCIgbWFyZ2luaGVpZ2h0PVwiMFwiPjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly93d3cuZ29vZ2xldGFnc2VydmljZXMuY29tL2FjdGl2ZXZpZXcvanMvY3VycmVudC9yeF9saWRhci5qcz9jYWNoZT1yMjAxMTA5MTRcIj48L3NjcmlwdD48IS0tQ3JlYXRpdmUgMzIzMjM5MTk3IHNlcnZlZCBieSBhcHBuZXh1cyBQcmViaWQuanMgSGVhZGVyIEJpZGRpbmctLT48c2NyaXB0PndpbmRvdy5kaWNuZiA9IHt9Ozwvc2NyaXB0PjxzY3JpcHQgZGF0YS1qYz1cIjQyXCIgZGF0YS1qYy12ZXJzaW9uPVwicjIwMjExMjAxXCIgZGF0YS1qYy1mbGFncz1cIlsmcXVvdDt4JTI3ODQ0Nic5ZWZvdG0oJmFtcDsyMDA2Nzs%2BOCZhbXA7PmBkb3BiLyU8MTczMjI2MSE9bmVodWB%2BJnF1b3Q7XVwiPihmdW5jdGlvbigpey8qICBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMCAqLyAndXNlIHN0cmljdCc7dmFyIGRhPVwiZnVuY3Rpb25cIj09dHlwZW9mIE9iamVjdC5kZWZpbmVQcm9wZXJ0aWVzP09iamVjdC5kZWZpbmVQcm9wZXJ0eTpmdW5jdGlvbihhLGIsYyl7aWYoYT09QXJyYXkucHJvdG90eXBlfHxhPT1PYmplY3QucHJvdG90eXBlKXJldHVybiBhO2FbYl09Yy52YWx1ZTtyZXR1cm4gYX07ZnVuY3Rpb24gZWEoYSl7YT1bXCJvYmplY3RcIj09dHlwZW9mIGdsb2JhbFRoaXMmJmdsb2JhbFRoaXMsYSxcIm9iamVjdFwiPT10eXBlb2Ygd2luZG93JiZ3aW5kb3csXCJvYmplY3RcIj09dHlwZW9mIHNlbGYmJnNlbGYsXCJvYmplY3RcIj09dHlwZW9mIGdsb2JhbCYmZ2xvYmFsXTtmb3IodmFyIGI9MDtiPGEubGVuZ3RoOysrYil7dmFyIGM9YVtiXTtpZihjJiZjLk1hdGg9PU1hdGgpcmV0dXJuIGN9dGhyb3cgRXJyb3IoXCJDYW5ub3QgZmluZCBnbG9iYWwgb2JqZWN0XCIpO312YXIgZmE9ZWEodGhpcyk7IGZ1bmN0aW9uIGhhKGEsYil7aWYoYilhOnt2YXIgYz1mYTthPWEuc3BsaXQoXCIuXCIpO2Zvcih2YXIgZD0wO2Q8YS5sZW5ndGgtMTtkKyspe3ZhciBmPWFbZF07aWYoIShmIGluIGMpKWJyZWFrIGE7Yz1jW2ZdfWE9YVthLmxlbmd0aC0xXTtkPWNbYV07Yj1iKGQpO2IhPWQmJm51bGwhPWImJmRhKGMsYSx7Y29uZmlndXJhYmxlOiEwLHdyaXRhYmxlOiEwLHZhbHVlOmJ9KX19aGEoXCJnbG9iYWxUaGlzXCIsZnVuY3Rpb24oYSl7cmV0dXJuIGF8fGZhfSk7dmFyIHI9dGhpc3x8c2VsZjtmdW5jdGlvbiB0KGEpe3RbXCIgXCJdKGEpO3JldHVybiBhfXRbXCIgXCJdPWZ1bmN0aW9uKCl7fTt2YXIgaWE9e30sdz1udWxsOyBmdW5jdGlvbiBqYShhLGIpe3ZvaWQgMD09PWImJihiPTApO2lmKCF3KXt3PXt9O2Zvcih2YXIgYz1cIkFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5XCIuc3BsaXQoXCJcIiksZD1bXCIrLz1cIixcIisvXCIsXCItXz1cIixcIi1fLlwiLFwiLV9cIl0sZj0wOzU%2BZjtmKyspe3ZhciBnPWMuY29uY2F0KGRbZl0uc3BsaXQoXCJcIikpO2lhW2ZdPWc7Zm9yKHZhciBlPTA7ZTxnLmxlbmd0aDtlKyspe3ZhciBrPWdbZV07dm9pZCAwPT09d1trXSYmKHdba109ZSl9fX1iPWlhW2JdO2M9QXJyYXkoTWF0aC5mbG9vcihhLmxlbmd0aC8zKSk7ZD1iWzY0XXx8XCJcIjtmb3IoZj1nPTA7ZzxhLmxlbmd0aC0yO2crPTMpe3ZhciBoPWFbZ10sbD1hW2crMV07az1hW2crMl07ZT1iW2g%2BPjJdO2g9YlsoaCYzKTw8NHxsPj40XTtsPWJbKGwmMTUpPDwyfGs%2BPjZdO2s9YltrJjYzXTtjW2YrK109ZStoK2wra31lPTA7az1kO3N3aXRjaChhLmxlbmd0aC1nKXtjYXNlIDI6ZT0gYVtnKzFdLGs9YlsoZSYxNSk8PDJdfHxkO2Nhc2UgMTphPWFbZ10sY1tmXT1iW2E%2BPjJdK2JbKGEmMyk8PDR8ZT4%2BNF0raytkfXJldHVybiBjLmpvaW4oXCJcIil9O3ZhciBrYT1cImZ1bmN0aW9uXCI9PT10eXBlb2YgVWludDhBcnJheTtjb25zdCB4PVN5bWJvbCh2b2lkIDApO2Z1bmN0aW9uIHooYSl7T2JqZWN0LmlzRnJvemVuKGEpfHwoeD9hW3hdfD0xOnZvaWQgMCE9PWEuZz9hLmd8PTE6T2JqZWN0LmRlZmluZVByb3BlcnRpZXMoYSx7Zzp7dmFsdWU6MSxjb25maWd1cmFibGU6ITAsd3JpdGFibGU6ITAsZW51bWVyYWJsZTohMX19KSk7cmV0dXJuIGF9O2Z1bmN0aW9uIGxhKGEpe3JldHVybiBudWxsIT09YSYmXCJvYmplY3RcIj09PXR5cGVvZiBhJiZhLmNvbnN0cnVjdG9yPT09T2JqZWN0fWxldCBBO2Z1bmN0aW9uIG1hKGEpe3N3aXRjaCh0eXBlb2YgYSl7Y2FzZSBcIm51bWJlclwiOnJldHVybiBpc0Zpbml0ZShhKT9hOlN0cmluZyhhKTtjYXNlIFwib2JqZWN0XCI6aWYoa2EmJm51bGwhPWEmJmEgaW5zdGFuY2VvZiBVaW50OEFycmF5KXJldHVybiBqYShhKX1yZXR1cm4gYX07ZnVuY3Rpb24gbmEoYSxiKXtpZihudWxsIT1hKXJldHVybiBBcnJheS5pc0FycmF5KGEpfHxsYShhKT9CKGEsYik6YihhKX1mdW5jdGlvbiBCKGEsYil7aWYoQXJyYXkuaXNBcnJheShhKSl7dmFyIGM9QXJyYXkoYS5sZW5ndGgpO2ZvcihsZXQgZj0wO2Y8YS5sZW5ndGg7ZisrKWNbZl09bmEoYVtmXSxiKTtpZihiPUFycmF5LmlzQXJyYXkoYSkpe3ZhciBkO3g%2FZD1hW3hdOmQ9YS5nO2I9KG51bGw9PWQ%2FMDpkKSYxfWImJnooYyk7cmV0dXJuIGN9ZD17fTtmb3IoYyBpbiBhKWRbY109bmEoYVtjXSxiKTtyZXR1cm4gZH1mdW5jdGlvbiBvYShhKXthPW1hKGEpO3JldHVybiBBcnJheS5pc0FycmF5KGEpP0IoYSxvYSk6YX07bGV0IHBhO2Z1bmN0aW9uIEQoKXt2YXIgYT12b2lkIDAsYj1xYSxjPXBhO3BhPW51bGw7YXx8KGE9Yyk7Yz10aGlzLmNvbnN0cnVjdG9yLnY7YXx8KGE9Yz9bY106W10pO3RoaXMuaD0oYz8wOi0xKS0odGhpcy5jb25zdHJ1Y3Rvci51fHwwKTt0aGlzLmc9YTthOntjPXRoaXMuZy5sZW5ndGg7YT1jLTE7aWYoYyYmKGM9dGhpcy5nW2FdLGxhKGMpKSl7dGhpcy5qPWEtdGhpcy5oO3RoaXMuaT1jO2JyZWFrIGF9dGhpcy5qPU51bWJlci5NQVhfVkFMVUV9aWYoYilmb3IoYT0wO2E8Yi5sZW5ndGg7YSsrKWlmKGM9YlthXSxjPHRoaXMuail7Yys9dGhpcy5oO3ZhciBkPXRoaXMuZ1tjXTtkP0FycmF5LmlzQXJyYXkoZCkmJnooZCk6dGhpcy5nW2NdPXJhfWVsc2Ugc2EodGhpcyksKGQ9dGhpcy5pW2NdKT9BcnJheS5pc0FycmF5KGQpJiZ6KGQpOnRoaXMuaVtjXT1yYX1jb25zdCByYT1PYmplY3QuZnJlZXplKHooW10pKTsgZnVuY3Rpb24gc2EoYSl7bGV0IGI9YS5qK2EuaDthLmdbYl18fChhLmk9YS5nW2JdPXt9KX1mdW5jdGlvbiBFKGEsYixjKXtiPj1hLmo%2FKHNhKGEpLGEuaVtiXT1jKTphLmdbYithLmhdPWM7cmV0dXJuIGF9RC5wcm90b3R5cGUudG9KU09OPWZ1bmN0aW9uKCl7Y29uc3QgYT10aGlzLmc7cmV0dXJuIEE%2FYTpCKGEsb2EpfTtmdW5jdGlvbiB0YShhLGIpe3JldHVybiBtYShiKX1ELnByb3RvdHlwZS50b1N0cmluZz1mdW5jdGlvbigpe3JldHVybiB0aGlzLmcudG9TdHJpbmcoKX07Y2xhc3MgdWF7Y29uc3RydWN0b3IoYSl7dGhpcy5rZXk9YX19dmFyIEY9Y2xhc3MgZXh0ZW5kcyB1YXtjb25zdHJ1Y3RvcihhKXtzdXBlcihhKTt0aGlzLmRlZmF1bHRWYWx1ZT0hMX19O3ZhciB2YT1uZXcgRihcIjQ1MzU3MT&i=1-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
7DMr-o5qFFEwKj55rV2E_ZacFaWhuinZ7PsZHylywoTTPJCaFRaJdw==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
425 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=U2XCIpLHdhPW5ldyBGKFwiNDUzNTA4OTBcIik7dmFyIEc9KGEsYik9PlwiJmFkdXJsPVwiPT1hLnN1YnN0cmluZyhhLmxlbmd0aC03KT9hLnN1YnN0cmluZygwLGEubGVuZ3RoLTcpK2IrXCImYWR1cmw9XCI6YStiOy8qICBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMCAqLyBmdW5jdGlvbiBIKGEsYixjKXthLmFkZEV2ZW50TGlzdGVuZXImJmEuYWRkRXZlbnRMaXN0ZW5lcihiLGMsITEpfTt2YXIgeGE9UmVnRXhwKFwiXig%2FOihbXjovPyMuXSspOik%2FKD86Ly8oPzooW15cXFxcXFxcXC8%2FI10qKUApPyhbXlxcXFxcXFxcLz8jXSo%2FKSg%2FOjooWzAtOV0rKSk%2FKD89W1xcXFxcXFxcLz8jXXwkKSk%2FKFtePyNdKyk%2FKD86XFxcXD8oW14jXSopKT8oPzojKFtcXFxcc1xcXFxTXSopKT8kXCIpO2Z1bmN0aW9uIEkoYSl7dHJ5e3ZhciBiO2lmKGI9ISFhJiZudWxsIT1hLmxvY2F0aW9uLmhyZWYpYTp7dHJ5e3QoYS5mb28pO2I9ITA7YnJlYWsgYX1jYXRjaChjKXt9Yj0hMX1yZXR1cm4gYn1jYXRjaChjKXtyZXR1cm4hMX19ZnVuY3Rpb24geWEoKXtpZighZ2xvYmFsVGhpcy5jcnlwdG8pcmV0dXJuIE1hdGgucmFuZG9tKCk7dHJ5e2NvbnN0IGE9bmV3IFVpbnQzMkFycmF5KDEpO2dsb2JhbFRoaXMuY3J5cHRvLmdldFJhbmRvbVZhbHVlcyhhKTtyZXR1cm4gYVswXS82NTUzNi82NTUzNn1jYXRjaChhKXtyZXR1cm4gTWF0aC5yYW5kb20oKX19ZnVuY3Rpb24gSihhLGIpe2lmKGEpZm9yKGNvbnN0IGMgaW4gYSlPYmplY3QucHJvdG90eXBlLmhhc093blByb3BlcnR5LmNhbGwoYSxjKSYmYi5jYWxsKHZvaWQgMCxhW2NdLGMsYSl9ZnVuY3Rpb24gRGEoYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmV0dXJuIGEuY3JlYXRlRWxlbWVudChcImltZ1wiKX07ZnVuY3Rpb24gTChhLGIsYz1udWxsKXtFYShhLGIsYyl9ZnVuY3Rpb24gRWEoYSxiLGMpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoYS5nb29nbGVfaW1hZ2VfcmVxdWVzdHM9W10pO2NvbnN0IGQ9RGEoYS5kb2N1bWVudCk7aWYoYyl7Y29uc3QgZj1nPT57YyYmYyhnKTtkLnJlbW92ZUV2ZW50TGlzdGVuZXImJmQucmVtb3ZlRXZlbnRMaXN0ZW5lcihcImxvYWRcIixmLCExKTtkLnJlbW92ZUV2ZW50TGlzdGVuZXImJmQucmVtb3ZlRXZlbnRMaXN0ZW5lcihcImVycm9yXCIsZiwhMSl9O0goZCxcImxvYWRcIixmKTtIKGQsXCJlcnJvclwiLGYpfWQuc3JjPWI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMucHVzaChkKX0gdmFyIEdhPSgpPT57bGV0IGE9XCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWJhZHB1YndpblwiO0ooe3N0YWNrOkVycm9yKCkuc3RhY2ssYXN3aWZ0OndpbmRvdy5nb29nbGVfYXN5bmNfaWZyYW1lX2lkfSwoYixjKT0%2Be2ImJihhKz1gJiR7Y309JHtlbmNvZGVVUklDb21wb25lbnQoYil9YCl9KTtGYShhKX0sRmE9YT0%2Be3ZhciBiPXdpbmRvdztiLmZldGNoP2IuZmV0Y2goYSx7a2VlcGFsaXZlOiEwLGNyZWRlbnRpYWxzOlwiaW5jbHVkZVwiLHJlZGlyZWN0OlwiZm9sbG93XCIsbWV0aG9kOlwiZ2V0XCIsbW9kZTpcIm5vLWNvcnNcIn0pOkwoYixhKX07bGV0IE09MDtmdW5jdGlvbiBIYShhLGI9bnVsbCl7cmV0dXJuIGImJmIuZ2V0QXR0cmlidXRlKFwiZGF0YS1qY1wiKT09PVN0cmluZyhhKT9iOmRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoYFske1wiZGF0YS1qY1wifT1cIiR7YX1cIl1gKX07ZnVuY3Rpb24gSWEoYSl7Tnx8KE49bmV3IEphKTtjb25zdCBiPU4uZ1thLmtleV07aWYoYSBpbnN0YW5jZW9mIEYpcmV0dXJuXCJib29sZWFuXCI9PT10eXBlb2YgYj9iOmEuZGVmYXVsdFZhbHVlO3Rocm93IEVycm9yKCk7fXZhciBLYT1jbGFzc3tjb25zdHJ1Y3Rvcigpe3RoaXMuZz17fX19O3ZhciBKYT1jbGFzcyBleHRlbmRzIEthe2NvbnN0cnVjdG9yKCl7c3VwZXIoKTt2YXIgYT1IYShNLGRvY3VtZW50LmN1cnJlbnRTY3JpcHQpO2E9YSYmYS5nZXRBdHRyaWJ1dGUoXCJkYXRhLWpjLWZsYWdzXCIpfHxcIlwiO3RyeXtjb25zdCBiPUpTT04ucGFyc2UoYSlbMF07YT1cIlwiO2ZvcihsZXQgYz0wO2M8Yi5sZW5ndGg7YysrKWErPVN0cmluZy5mcm9tQ2hhckNvZGUoYi5jaGFyQ29kZUF0KGMpXlwiXFx1MDAwM1xcdTAwMDdcXHUwMDAzXFx1MDAwN1xcYlxcdTAwMDRcXHUwMDA0XFx1MDAwNlxcdTAwMDVcXHUwMDAzXCIuY2hhckNvZGVBdChjJTEwKSk7dGhpcy5nPUpTT04ucGFyc2UoYSl9Y2F0Y2goYil7fX19LE47dmFyIExhPWRvY3VtZW50LE1hPXdpbmRvdzt2YXIgTmE9ISF3aW5kb3cuZ29vZ2xlX2FzeW5jX2lmcmFtZV9pZDtsZXQgTz1OYSYmd2luZG93LnBhcmVudHx8d2luZG93O2NsYXNzIE9he2NvbnN0cnVjdG9yKGEsYil7dGhpcy5lcnJvcj1hO3RoaXMuY29udGV4dD1iLmNvbnRleHQ7dGhpcy5tc2c9Yi5tZXNzYWdlfHxcIlwiO3RoaXMuaWQ9Yi5pZHx8XCJqc2Vycm9yXCI7dGhpcy5tZXRhPXt9fX07Y29uc3QgUGE9UmVnRXhwKFwiXmh0dHBzPzovLyhcXFxcd3wtKStcXFxcLmNkblxcXFwuYW1wcHJvamVjdFxcXFwuKG5ldHxvcmcpKFxcXFw%2FfC98JClcIik7dmFyIFFhPWNsYXNze2NvbnN0cnVjdG9yKGEsYil7dGhpcy5nPWE7dGhpcy5oPWJ9fSxSYT1jbGFzc3tjb25zdHJ1Y3RvcihhLGIpe3RoaXMudXJsPWE7dGhpcy5tPSEhYjt0aGlzLmRlcHRoPW51bGx9fTtmdW5jdGlvbiBQKGEsYil7Y29uc3QgYz17fTtjW2FdPWI7cmV0dXJuW2NdfWZ1bmN0aW9uIFNhKGEsYixjLGQsZil7Y29uc3QgZz1bXTtKKGEsZnVuY3Rpb24oZSxrKXsoZT1UYShlLGIsYyxkLGYpKSYmZy5wdXNoKGsrXCI9XCIrZSl9KTtyZXR1cm4gZy5qb2luKGIpfSBmdW5jdGlvbiBUYShhLGIsYyxkLGYpe2lmKG51bGw9PWEpcmV0dXJuXCJcIjtiPWJ8fFwiJlwiO2M9Y3x8XCIsJFwiO1wic3RyaW5nXCI9PXR5cGVvZiBjJiYoYz1jLnNwbGl0KFwiXCIpKTtpZihhIGluc3RhbmNlb2YgQXJyYXkpe2lmKGQ9ZHx8MCxkPGMubGVuZ3RoKXtjb25zdCBnPVtdO2ZvcihsZXQgZT0wO2U8YS5sZW5ndGg7ZSsrKWcucHVzaChUYShhW2VdLGIsYyxkKzEsZikpO3JldHVybiBnLmpvaW4oY1tkXSl9fWVsc2UgaWYoXCJvYmplY3RcIj09dHlwZW9mIGEpcmV0dXJuIGY9Znx8MCwyPmY%2FZW5jb2RlVVJJQ29tcG9uZW50KFNhKGEsYixjLGQsZisxKSk6XCIuLi5cIjtyZXR1cm4gZW5jb2RlVVJJQ29tcG9uZW50KFN0cmluZyhhKSl9ZnVuY3Rpb24gVWEoYSl7bGV0IGI9MTtmb3IoY29uc3QgYyBpbiBhLmgpYj1jLmxlbmd0aD5iP2MubGVuZ3RoOmI7cmV0dXJuIDM5OTctYi1hLmkubGVuZ3RoLTF9IGZ1bmN0aW9uIFZhKGEsYixjKXtiPWIrXCIvL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tXCIrYztsZXQgZD1VYShhKS1jLmxlbmd0aDtpZigwPmQpcmV0dXJuXCJcIjthLmcuc29ydChmdW5jdGlvbihnLGUpe3JldHVybiBnLWV9KTtjPW51bGw7bGV0IGY9XCJcIjtmb3IobGV0IGc9MDtnPGEuZy5sZW5ndGg7ZysrKXtjb25zdCBlPWEuZ1tnXSxrPWEuaFtlXTtmb3IobGV0IGg9MDtoPGsubGVuZ3RoO2grKyl7aWYoIWQpe2M9bnVsbD09Yz9lOmM7YnJlYWt9bGV0IGw9U2Eoa1toXSxhLmksXCIsJFwiKTtpZihsKXtsPWYrbDtpZihkPj1sLmxlbmd0aCl7ZC09bC5sZW5ndGg7Yis9bDtmPWEuaTticmVha31jPW51bGw9PWM%2FZTpjfX19YT1cIlwiO251bGwhPWMmJihhPWYrXCJ0cm49XCIrYyk7cmV0dXJuIGIrYX1jbGFzcyBRe2NvbnN0cnVjdG9yKCl7dGhpcy5pPVwiJlwiO3RoaXMuaD17fTt0aGlzLmo9MDt0aGlzLmc9W119fTtmdW5jdGlvbiBXYSgpe3ZhciBhPVIsYj1TLmdvb2dsZV9zcnQ7MDw9YiYmMT49YiYmKGEuZz1iKX1mdW5jdGlvbiBUKGEsYixjLGQsZixnKXtpZigoZD9hLmc6TWF0aC5yYW5kb20oKSk8KGZ8fC4wMSkpdHJ5e2xldCBlO2MgaW5zdGFuY2VvZiBRP2U9YzooZT1uZXcgUSxKKGMsKGgsbCk9Pnt2YXIgbT1lLG49bS5qKys7aD1QKGwsaCk7bS5nLnB1c2gobik7bS5oW25dPWh9KSk7Y29uc3Qgaz1WYShlLGEuaCxcIi9wYWdlYWQvZ2VuXzIwND9pZD1cIitiK1wiJlwiKTtrJiYoXCJ1bmRlZmluZWRcIiE9PXR5cGVvZiBnP0wocixrLGcpOkwocixrKSl9Y2F0Y2goZSl7fX1jbGFzcyBYYXtjb25zdHJ1Y3Rvcigpe3ZhciBhPXZvaWQgMD09PWE%2FTWE6YTt0aGlzLmg9XCJodHRwOlwiPT09YS5sb2NhdGlvbi5wcm90b2NvbD9cImh0dHA6XCI6XCJodHRwczpcIjt0aGlzLmc9TWF0aC5yYW5kb20oKX19O2xldCBVPW51bGw7dmFyIFlhPSgpPT57Y29uc3QgYT1yLnBlcmZvcm1hbmNlO3JldHVybiBhJiZhLm5vdyYmYS50aW1pbmc%2FTWF0aC5mbG9vcihhLm5vdygpK2EudGltaW5nLm5hdmlnYXRpb25TdGFydCk6RGF0ZS5ub3coKX0sWmE9KCk9Pntjb25zdCBhPXIucGVyZm9ybWFuY2U7cmV0dXJuIGEmJmEubm93P2Eubm93KCk6bnVsbH07Y2xhc3MgJGF7Y29uc3RydWN0b3IoYSxiKXt2YXIgYz1aYSgpfHxZYSgpO3RoaXMubGFiZWw9YTt0aGlzLnR5cGU9Yjt0aGlzLnZhbHVlPWM7dGhpcy5kdXJhdGlvbj0wO3RoaXMudW5pcXVlSWQ9TWF0aC5yYW5kb20oKTt0aGlzLnNsb3RJZD12b2lkIDB9fTtjb25zdCBWPXIucGVyZm9ybWFuY2UsYWI9ISEoViYmVi5tYXJrJiZWLm1lYXN1cmUmJlYuY2xlYXJNYXJrcyksVz1mdW5jdGlvbihhKXtsZXQgYj0hMSxjO3JldHVybiBmdW5jdGlvbigpe2J8fChjPWEoKSxiPSEwKTtyZXR1cm4gY319KCgpPT57dmFyIGE7aWYoYT1hYil7dmFyIGI7aWYobnVsbD09PVUpe1U9XCJcIjt0cnl7YT1cIlwiO3RyeXthPXIudG9wLmxvY2F0aW9uLmhhc2h9Y2F0Y2goYyl7YT1yLmxvY2F0aW9uLmhhc2h9YSYmKFU9KGI9YS5tYXRjaCgvXFxiZGVpZD0oW1xcZCxdKykvKSk%2FYlsxXTpcIlwiKX1jYXRjaChjKXt9fWI9VTthPSEhYi5pbmRleE9mJiYwPD1iLmluZGV4T2YoXCIxMzM3XCIpfXJldHVybiBhfSk7ZnVuY3Rpb24gYmIoYSl7YSYmViYmVygpJiYoVi5jbGVhck1hcmtzKGBnb29nXyR7YS5sYWJlbH1fJHthLnVuaXF1ZUlkfV9zdGFydGApLFYuY2xlYXJNYXJrcyhgZ29vZ18ke2EubGFiZWx9XyR7YS51bmlxdWVJZH1fZW5kYCkpfSBjbGFzcyBjYntjb25zdHJ1Y3Rvcigpe3ZhciBhPVM7dGhpcy5oPVtdO3RoaXMuaT1hfHxyO2xldCBiPW51bGw7YSYmKGEuZ29vZ2xlX2pzX3JlcG9ydGluZ19xdWV1ZT1hLmdvb2dsZV9qc19yZXBvcnRpbmdfcXVldWV8fFtdLHRoaXMuaD1hLmdvb2dsZV9qc19yZXBvcnRpbmdfcXVldWUsYj1hLmdvb2dsZV9tZWFzdXJlX2pzX3RpbWluZyk7dGhpcy5nPVcoKXx8KG51bGwhPWI%2FYjoxPk1hdGgucmFuZG9tKCkpfXN0YXJ0KGEsYil7aWYoIXRoaXMuZylyZXR1cm4gbnVsbDthPW5ldyAkYShhLGIpO2I9YGdvb2dfJHthLmxhYmVsfV8ke2EudW5pcXVlSWR9X3N0YXJ0YDtWJiZXKCkmJlYubWFyayhiKTtyZXR1cm4gYX1lbmQoYSl7aWYodGhpcy5nJiZcIm51bWJlclwiPT09dHlwZW9mIGEudmFsdWUpe2EuZHVyYXRpb249KFphKCl8fFlhKCkpLWEudmFsdWU7dmFyIGI9YGdvb2dfJHthLmxhYmVsfV8ke2EudW5pcXVlSWR9X2VuZGA7ViYmVygpJiZWLm1hcmsoYik7IXRoaXMuZ3x8MjA0ODx0aGlzLmgubGVuZ3RofHwgdGhpcy5oLnB1c2goYSl9fX07ZnVuY3Rpb24gWChhKXtsZXQgYj1hLnRvU3RyaW5nKCk7YS5uYW1lJiYtMT09Yi5pbmRleE9mKGEubmFtZSkmJihiKz1cIjogXCIrYS5uYW1lKTthLm1lc3NhZ2UmJi0xPT1iLmluZGV4T2YoYS5tZXNzYWdlKSYmKGIrPVwiOiBcIithLm1lc3NhZ2UpO2lmKGEuc3RhY2spe2E9YS5zdGFjazt0cnl7LTE9PWEuaW5kZXhPZihiKSYmKGE9YitcIlxcblwiK2EpO2xldCBjO2Zvcig7YSE9YzspYz1hLGE9YS5yZXBsYWNlKC8oKGh0dHBzPzpcXC8uLipcXC8pW15cXC86XSo6XFxkKyg%2FOi58XFxuKSopXFwyLyxcIiQxXCIpO2I9YS5yZXBsYWNlKC9cXG4gKi9nLFwiXFxuXCIpfWNhdGNoKGMpe319cmV0dXJuIGJ9IGZ1bmN0aW9uIGRiKGEsYil7bGV0IGMsZDt0cnl7YS5nJiZhLmcuZz8oZD1hLmcuc3RhcnQoKDkwMykudG9TdHJpbmcoKSwzKS&i=2-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
RMO4lD170Ot4NPaKQt59ipY44diB5c7otr0KITS1T-TSmEJ7VHEleA==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
424 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=xjPWIoKSxhLmcuZW5kKGQpKTpjPWIoKX1jYXRjaChmKXtiPSEwO3RyeXtiYihkKSxiPWEucyg5MDMsbmV3IE9hKGYse21lc3NhZ2U6WChmKX0pLHZvaWQgMCx2b2lkIDApfWNhdGNoKGcpe2EubygyMTcsZyl9aWYoYil7bGV0IGcsZTtudWxsPT0oZz13aW5kb3cuY29uc29sZSl8fG51bGw9PShlPWcuZXJyb3IpfHxlLmNhbGwoZyxmKX1lbHNlIHRocm93IGY7fXJldHVybiBjfWZ1bmN0aW9uIGViKGEpe3ZhciBiPVk7cmV0dXJuKC4uLmMpPT5kYihiLCgpPT5hLmFwcGx5KHZvaWQgMCxjKSl9IGNsYXNzIGZie2NvbnN0cnVjdG9yKCl7dmFyIGE9Wjt0aGlzLmk9Ujt0aGlzLmg9bnVsbDt0aGlzLnM9dGhpcy5vO3RoaXMuZz12b2lkIDA9PT1hP251bGw6YTt0aGlzLmo9ITF9cGluZ2VyKCl7cmV0dXJuIHRoaXMuaX1vKGEsYixjLGQsZil7Zj1mfHxcImpzZXJyb3JcIjtsZXQgZzt0cnl7Y29uc3Qgdj1uZXcgUTt2YXIgZT12O2UuZy5wdXNoKDEpO2UuaFsxXT1QKFwiY29udGV4dFwiLGEpO2IuZXJyb3ImJmIubWV0YSYmYi5pZHx8KGI9bmV3IE9hKGIse21lc3NhZ2U6WChiKX0pKTtpZihiLm1zZyl7ZT12O3ZhciBrPWIubXNnLnN1YnN0cmluZygwLDUxMik7ZS5nLnB1c2goMik7ZS5oWzJdPVAoXCJtc2dcIixrKX12YXIgaD1iLm1ldGF8fHt9O2I9aDtpZih0aGlzLmgpdHJ5e3RoaXMuaChiKX1jYXRjaCh5KXt9aWYoZCl0cnl7ZChiKX1jYXRjaCh5KXt9ZD12O2g9W2hdO2QuZy5wdXNoKDMpO2QuaFszXT1oO2Q9cjtoPVtdO2I9bnVsbDtkb3t2YXIgbD1kO2lmKEkobCkpe3ZhciBtPWwubG9jYXRpb24uaHJlZjsgYj1sLmRvY3VtZW50JiZsLmRvY3VtZW50LnJlZmVycmVyfHxudWxsfWVsc2UgbT1iLGI9bnVsbDtoLnB1c2gobmV3IFJhKG18fFwiXCIpKTt0cnl7ZD1sLnBhcmVudH1jYXRjaCh5KXtkPW51bGx9fXdoaWxlKGQmJmwhPWQpO2ZvcihsZXQgeT0wLHphPWgubGVuZ3RoLTE7eTw9emE7Kyt5KWhbeV0uZGVwdGg9emEteTtsPXI7aWYobC5sb2NhdGlvbiYmbC5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMmJmwubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zLmxlbmd0aD09aC5sZW5ndGgtMSlmb3IobT0xO208aC5sZW5ndGg7KyttKXt2YXIgbj1oW21dO24udXJsfHwobi51cmw9bC5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnNbbS0xXXx8XCJcIixuLm09ITApfXZhciB1PWg7bGV0IEs9bmV3IFJhKHIubG9jYXRpb24uaHJlZiwhMSk7bD1udWxsO2NvbnN0IGFhPXUubGVuZ3RoLTE7Zm9yKG49YWE7MDw9bjstLW4pe3ZhciBwPXVbbl07IWwmJlBhLnRlc3QocC51cmwpJiYobD1wKTtpZihwLnVybCYmIXAubSl7Sz0gcDticmVha319cD1udWxsO2NvbnN0IGpiPXUubGVuZ3RoJiZ1W2FhXS51cmw7MCE9Sy5kZXB0aCYmamImJihwPXVbYWFdKTtnPW5ldyBRYShLLHApO2lmKGcuaCl7dT12O3ZhciBxPWcuaC51cmx8fFwiXCI7dS5nLnB1c2goNCk7dS5oWzRdPVAoXCJ0b3BcIixxKX12YXIgYmE9e3VybDpnLmcudXJsfHxcIlwifTtpZihnLmcudXJsKXt2YXIgY2E9Zy5nLnVybC5tYXRjaCh4YSksQz1jYVsxXSxBYT1jYVszXSxCYT1jYVs0XTtxPVwiXCI7QyYmKHErPUMrXCI6XCIpO0FhJiYocSs9XCIvL1wiLHErPUFhLEJhJiYocSs9XCI6XCIrQmEpKTt2YXIgQ2E9cX1lbHNlIENhPVwiXCI7Qz12O2JhPVtiYSx7dXJsOkNhfV07Qy5nLnB1c2goNSk7Qy5oWzVdPWJhO1QodGhpcy5pLGYsdix0aGlzLmosYyl9Y2F0Y2godil7dHJ5e1QodGhpcy5pLGYse2NvbnRleHQ6XCJlY21zZXJyXCIscmN0eDphLG1zZzpYKHYpLHVybDpnJiZnLmcudXJsfSx0aGlzLmosYyl9Y2F0Y2goSyl7fX1yZXR1cm4hMH19O2NsYXNzIGdie307bGV0IFIsWTtpZihOYSYmIUkoTykpe2xldCBhPVwiLlwiK0xhLmRvbWFpbjt0cnl7Zm9yKDsyPGEuc3BsaXQoXCIuXCIpLmxlbmd0aCYmIUkoTyk7KUxhLmRvbWFpbj1hPWEuc3Vic3RyKGEuaW5kZXhPZihcIi5cIikrMSksTz13aW5kb3cucGFyZW50fWNhdGNoKGIpe31JKE8pfHwoTz13aW5kb3cpfU8hPT13aW5kb3cmJi4wMT5NYXRoLnJhbmRvbSgpJiZHYSgpO2NvbnN0IFM9TyxaPW5ldyBjYjt2YXIgaGI9KCk9PntpZighUy5nb29nbGVfbWVhc3VyZV9qc190aW1pbmcpe3ZhciBhPVo7YS5nPSExO2EuaCE9YS5pLmdvb2dsZV9qc19yZXBvcnRpbmdfcXVldWUmJihXKCkmJkFycmF5LnByb3RvdHlwZS5mb3JFYWNoLmNhbGwoYS5oLGJiLHZvaWQgMCksYS5oLmxlbmd0aD0wKX19OyAoYT0%2Be1I9bnVsbCE9YT9hOm5ldyBYYTtcIm51bWJlclwiIT09dHlwZW9mIFMuZ29vZ2xlX3NydCYmKFMuZ29vZ2xlX3NydD1NYXRoLnJhbmRvbSgpKTtXYSgpO1k9bmV3IGZiO1kuaD1iPT57dmFyIGM9TTswIT09YyYmKGIuamM9U3RyaW5nKGMpLGM9KGM9SGEoYyxkb2N1bWVudC5jdXJyZW50U2NyaXB0KSkmJmMuZ2V0QXR0cmlidXRlKFwiZGF0YS1qYy12ZXJzaW9uXCIpfHxcInVua25vd25cIixiLnNodj1jKX07WS5qPSEwO1wiY29tcGxldGVcIj09Uy5kb2N1bWVudC5yZWFkeVN0YXRlP2hiKCk6Wi5nJiZIKFMsXCJsb2FkXCIsKCk9PntoYigpfSl9KSgpO2Z1bmN0aW9uIGliKCl7dmFyIGEsYjtjb25zdCBjPXdpbmRvdztpZihjLmdtYVNka3x8KG51bGw9PT0oYT1jLndlYmtpdCl8fHZvaWQgMD09PWE%2FMDphLm1lc3NhZ2VIYW5kbGVycy5nZXRHbWFWaWV3U2lnbmFscykpcmV0dXJuIGM7dHJ5e2NvbnN0IGQ9d2luZG93LnBhcmVudDtpZihkLmdtYVNka3x8KG51bGw9PT0oYj1kLndlYmtpdCl8fHZvaWQgMD09PWI%2FMDpiLm1lc3NhZ2VIYW5kbGVycy5nZXRHbWFWaWV3U2lnbmFscykpcmV0dXJuIGR9Y2F0Y2goZCl7fXJldHVybiBudWxsfSBmdW5jdGlvbiBrYihhLGI9e30sYz0oKT0%2Be30sZD0oKT0%2Be30pe2NvbnN0IGY9U3RyaW5nKE1hdGguZmxvb3IoMjE0NzQ4MzY0Nyp5YSgpKSk7bGV0IGc9MDtjb25zdCBlPWs9Pnt0cnl7dmFyIGg9XCJvYmplY3RcIj09PXR5cGVvZiBrLmRhdGE%2Fay5kYXRhOkpTT04ucGFyc2Uoay5kYXRhKTtmPT09aC5wYXdfaWQmJih3aW5kb3cuY2xlYXJUaW1lb3V0KGcpLHdpbmRvdy5yZW1vdmVFdmVudExpc3RlbmVyKFwibWVzc2FnZVwiLGUpLGguc2lnbmFsP2MoaC5zaWduYWwpOmguZXJyb3ImJmQoaC5lcnJvcikpfWNhdGNoKG0pe2s9e21zZzpcInBvc3RtZXNzYWdlRXJyb3JcIixlcnI6bSBpbnN0YW5jZW9mIEVycm9yP20ubWVzc2FnZTpcIm5vbkVycm9yXCIsZGF0YTpudWxsPT1rLmRhdGE%2FXCJudWxsXCI6NTAwPGsuZGF0YS5sZW5ndGg%2Fay5kYXRhLnN1YnN0cmluZygwLDUwMCk6ay5kYXRhfTtoPWdiO3ZhciBsPVwibFwiO2gubCYmaC5oYXNPd25Qcm9wZXJ0eShsKXx8KGw9bmV3IGgsaC5sPWwpO2g9W107IWsuZWlkJiYgaC5sZW5ndGgmJihrLmVpZD1oLnRvU3RyaW5nKCkpO1QoUixcInBhd19zaWdzXCIsaywhMCx2b2lkIDAsdm9pZCAwKX19O3dpbmRvdy5hZGRFdmVudExpc3RlbmVyKFwibWVzc2FnZVwiLGViKGs9PntlKGspfSkpO2EucG9zdE1lc3NhZ2UoT2JqZWN0LmFzc2lnbih7cGF3X2lkOmZ9LGIpKTtnPXdpbmRvdy5zZXRUaW1lb3V0KCgpPT57d2luZG93LnJlbW92ZUV2ZW50TGlzdGVuZXIoXCJtZXNzYWdlXCIsZSk7ZChcIlBBVyBHTUEgcG9zdG1lc3NhZ2UgdGltZWQgb3V0LlwiKX0sMjAwKX07dmFyIGxiPWNsYXNzIGV4dGVuZHMgRHt9LHFhPVs2XTtjb25zdCBtYj1cInBsYXRmb3JtIHBsYXRmb3JtVmVyc2lvbiBhcmNoaXRlY3R1cmUgbW9kZWwgdWFGdWxsVmVyc2lvbiBiaXRuZXNzXCIuc3BsaXQoXCIgXCIpO3ZhciBuYj0oKT0%2Be3ZhciBhPXdpbmRvdztyZXR1cm4gYS5uYXZpZ2F0b3ImJmEubmF2aWdhdG9yLnVzZXJBZ2VudERhdGEmJlwiZnVuY3Rpb25cIj09PXR5cGVvZiBhLm5hdmlnYXRvci51c2VyQWdlbnREYXRhLmdldEhpZ2hFbnRyb3B5VmFsdWVzP2EubmF2aWdhdG9yLnVzZXJBZ2VudERhdGEuZ2V0SGlnaEVudHJvcHlWYWx1ZXMobWIpLnRoZW4oYj0%2Be3ZhciBjPW5ldyBsYjtjPUUoYywxLGIucGxhdGZvcm0pO2M9RShjLDIsYi5wbGF0Zm9ybVZlcnNpb24pO2M9RShjLDMsYi5hcmNoaXRlY3R1cmUpO2M9RShjLDQsYi5tb2RlbCk7Yz1FKGMsNSxiLnVhRnVsbFZlcnNpb24pO3JldHVybiBFKGMsOSxiLmJpdG5lc3MpfSk6bnVsbH07Y2xhc3Mgb2J7Y29uc3RydWN0b3IoKXt0aGlzLnByb21pc2U9bmV3IFByb21pc2UoYT0%2Be3RoaXMuZz1hfSl9fTt3aW5kb3cudmlld1JlcT1bXTtjb25zdCBwYj1hPT57Y29uc3QgYj1uZXcgSW1hZ2U7Yi5zcmM9YS5yZXBsYWNlKFwiJmFtcDtcIixcIiZcIik7d2luZG93LnZpZXdSZXEucHVzaChiKX0scWI9YT0%2Be2ZldGNoKGEse2tlZXBhbGl2ZTohMCxjcmVkZW50aWFsczpcImluY2x1ZGVcIixyZWRpcmVjdDpcImZvbGxvd1wiLG1ldGhvZDpcImdldFwiLG1vZGU6XCJuby1jb3JzXCJ9KS5jYXRjaCgoKT0%2Be3BiKGEpfSl9LHJiPWE9Pnt3aW5kb3cuZmV0Y2g%2FcWIoYSk6cGIoYSl9O009NDI7IHdpbmRvdy52dT1hPT57dmFyIGIsYyxkLGY7Y29uc3QgZz1JYSh2YSksZT1pYigpO2cmJm51bGwhPShudWxsPT09KGI9bnVsbD09PWV8fHZvaWQgMD09PWU%2Fdm9pZCAwOmUuZ21hU2RrKXx8dm9pZCAwPT09Yj92b2lkIDA6Yi5nZXRWaWV3U2lnbmFscykmJihiPW51bGw9PT0oYz1udWxsPT09ZXx8dm9pZCAwPT09ZT92b2lkIDA6ZS5nbWFTZGspfHx2b2lkIDA9PT1jP3ZvaWQgMDpjLmdldFZpZXdTaWduYWxzKCkpJiYoYT1HKGEsXCImbXM9XCIrYikpO2NvbnN0IGs9W107Yz0oKT0%2Be2NvbnN0IGg9bmV3IG9iO2sucHVzaChoLnByb21pc2UpO3JldHVybiBoLmd9O2lmKGI9SWEod2EpKXtjb25zdCBoPW5iKCk7aWYobnVsbCE9aCl7Y29uc3QgbD1jKCk7aC50aGVuKG09PnthOntBPSEwO3RyeXt2YXIgbj1KU09OLnN0cmluZ2lmeShtLnRvSlNPTigpLHRhKTticmVhayBhfWZpbmFsbHl7QT0hMX1uPXZvaWQgMH1tPW47bj1bXTtmb3IodmFyIHU9MCxwPTA7cDxtLmxlbmd0aDtwKyspe3ZhciBxPSBtLmNoYXJDb2RlQXQocCk7MjU1PHEmJihuW3UrK109cSYyNTUscT4%2BPTgpO25bdSsrXT1xfW09amEobiwzKTswPG0ubGVuZ3RoJiYoYT1HKGEsXCImdWFjaD1cIittKSk7bCgpfSl9fWlmKGcmJm51bGwhPShudWxsPT09KGQ9bnVsbD09PWV8fHZvaWQgMD09PWU%2Fdm9pZCAwOmUud2Via2l0KXx8dm9pZCAwPT09ZD92b2lkIDA6ZC5tZXNzYWdlSGFuZGxlcnMuZ2V0R21hVmlld1NpZ25hbHMpKXtjb25zdCBoPWMoKTtrYihudWxsPT09KGY9bnVsbD09PWV8fHZvaWQgMD09PWU%2Fdm9pZCAwOmUud2Via2l0KXx8dm9pZCAwPT09Zj92b2lkIDA6Zi5tZXNzYWdlSGFuZGxlcnMuZ2V0R21hVmlld1NpZ25hbHMse30sbD0%2Be2E9RyhhLFwiJlwiK2wpO2goKX0sKCk9PntoKCl9KX1ifHxnP1Byb21pc2UuYWxsKGspLnRoZW4oKCk9PntyYihhKX0pOnJiKGEpfTt9KS5jYWxsKHRoaXMpOzwvc2NyaXB0PjxzY3JpcHQ%2BdnUoXCJodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wY3Mvdmlldz94YWlcXHgzZEFLQU9qc3ZwaUxMaHMteXhRbV94eFFmb1c2bE9ycmhad0tGMHI4XzQtZW50b3AyTjJSQzc1bExSM3poVEhzeXhiVldZS0F6d25Qc0d2Q0FTa0dZTzBmY1dvYTh4VVh4UFZuX244NXBwMkx1LXhwdEVaVjV3Zzg3dS1CTXB1cF9tZkpOUGZjYmJxNWRzaTBlU2ZWWTliTUpOQzdXal9WUk43M255d2ZJdXZhNTZrZ01ua1hoM0ZTRlVSYzNueUVQTHZKekFEY2txdTJ5MzhjZ1NlZlRjbjNNM2RRZWZOMlR2aEk3eko0Sk1sV05IT3ZZbDJkaFNnZHV4eUZFRmVWQ0plNEtUVU5ac01BUzBjcmZCMTg5cEZ0d0cwbGJoVlFsODV3M1Roa0ZrQ25kdXZlLV93SEc4ZnVTRXdMYXc2aTFnN2JNeUNwVldkallBMVhNSmF5dEtMYzlPZTlobUl0RzR2VXR6TGlpaVRKSlUxYWJUem90MGxhRThRd1xceDI2c2lnXFx4M2RDZzBBcktKU3pJR3pUajU2cUUzR0VBRVxceDI2dWFjaF9tXFx4M2RbVUFDSF1cXHgyNnVybGZpeFxceDNkMVxceDI2YWR1cmxcXHgzZFwiKTwvc2NyaXB0PjxkaXYgY2xhc3M9XCJHb29nbGVBY3RpdmVWaWV3SW5uZXJDb250YWluZXJcIiBzdHlsZT1cImxlZnQ6&i=3-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
oqejCCWtODbjmhkVuSr330rFs7qfctxafn5Bu2ospzS_9K8kDntJtg==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=MHB4O3RvcDowcHg7d2lkdGg6MTAwJTtoZWlnaHQ6MTAwJTtwb3NpdGlvbjpmaXhlZDtwb2ludGVyLWV2ZW50czpub25lO3otaW5kZXg6LTk5OTk7XCI%2BPC9kaXY%2BPGRpdiBzdHlsZT1cImRpc3BsYXk6aW5saW5lXCIgY2xhc3M9XCJHb29nbGVBY3RpdmVWaWV3RWxlbWVudFwiIGRhdGEtZ29vZ2xlLWF2LWN4bj1cImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpPUFLQU9qc3Q4dEh0YTNpSnBYal9qbVBEU1Bib05fZ2NWZ2YzYUtfX3hWenRCamx0aExFYVFfWW9WbXFmMnVCQnFkejM2MU9QTjB4aFFzTzNaWWFGbEgyRDVFZzhGZDNWN0ZOSWI1MWdfSjAwa1MyNHp4Wmszd0I0UiZhbXA7c2lnPUNnMEFyS0pTelBNT01CRHV2VkhiRUFFXCIgZGF0YS1nb29nbGUtYXYtYWRrPVwiNTIzNTE4NzYxXCIgZGF0YS1nb29nbGUtYXYtbWV0YWRhdGE9XCJsYT0wJmFtcDt4ZGk9MCZhbXA7XCIgZGF0YS1nb29nbGUtYXYtb3ZlcnJpZGU9XCItMVwiIGRhdGEtZ29vZ2xlLWF2LWRtPVwiMlwiIGRhdGEtZ29vZ2xlLWF2LWltbWVkaWF0ZT1cIlwiIGRhdGEtZ29vZ2xlLWF2LWFpZD1cIjBcIiBkYXRhLWdvb2dsZS1hdi1uYWlkPVwiMVwiIGRhdGEtZ29vZ2xlLWF2LXNsaWZ0PVwiXCIgZGF0YS1nb29nbGUtYXYtY3BtYXY9XCJcIiBkYXRhLWdvb2dsZS1hdi1idHI9XCJodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wY3Mvdmlldz94YWk9QUtBT2pzc296UFdzYU5XdXdFcHJtVkNEdG5tU0NkSV8wTkNIQXhyMUM4dVU0WjB4d09rbVZydVFXam44cmVLNjBhOXZhOVdNdEo1WTZhVlNqTmFUazM2aXdIUDRFNzlvN1VFampsbG5fQlBaQ240QndTYXZ3cm9CaldLM2dqRnZKN04zcEpjY3pqS2JFUnExTWZQcXB3d09TMl8tN0lBTnVZaG5jNFd3akR4ZmYxOVVCUWg2aXV6SlZEZ3FNb2dxbUhzTUxzODlQemU2NHdXd1NUU2JKWlBCVkN3YVdCUXVlS3ZsZEd4QkhzU2RfMkt3UlJaUFZielh5VXV5RTFlYTdFdmtLSjZWdWlHYVRsVnlaZ3RxZkNGT21KWDNCX2FBWkRVaHZYTmZHeHFNWlJFLXVSeUxfcDhHOXlFNlE1V1J2MklJdlhaRlRTWlBGRWdoVEpyWk0xc0hrN3ZtX1NneVdSSDNlZ195QUhJa0xPaVZiek8wQkl2MW85UWUmYW1wO3NpZz1DZzBBcktKU3pNck82aUdKbUowaUVBRSZhbXA7dWFjaF9tPVtVQUNIXSZhbXA7dXJsZml4PTEmYW1wO2FkdXJsPVwiIGRhdGEtZ29vZ2xlLWF2LWl0cGw9XCIxOVwiIGRhdGEtZ29vZ2xlLWF2LXJzPVwiNFwiIGRhdGEtZ29vZ2xlLWF2LWZsYWdzPVwiWyZxdW90O3glMjc4NDQwJzllZm90bSgmYW1wOzc1MzM3NCUyYmVqdmYvJTI3ODQ0Pic5d3V2YiQmYW1wOzU2NTMzPiE9fHZxYykhMjczNzk0JmFtcDs8cXF2Yi8lPDE3MzUwMjAhPW5laHVgLyEzNjQ9NTA1MSE5YWJre2EoJDE2MDIxMDozJmFtcDs8Y2JvdGYrKjAxNTAwMzQ6JTJiZWp2Zi8lNzI7MTc2MTMhPWVmZHdhKic3NjQ2MzsyMSQ%2FZWJrcGIkJmFtcDswMzY2NzE3Pio%2BYmdpcGYrITM9NzEyMzYzJTlhaWh3YykhNzIwMjwyMTcnOWVmb3RtKCZhbXA7MjAwNjE7NDgmYW1wOz5gZG9wYi8lPDE3MDcyMDAhPTgoJmFtcDsyMDA1NTc1PyZhbXA7PmBkb3BifiZxdW90O11cIiBkYXRhLWNyZWF0aXZlLWxvYWQtbGlzdGVuZXI9XCJcIj48IS0tIEZyZWVzdGFyIEJhbm5lciBDcmVhdGl2ZSBJbmZvOiBCaWRkZXI6IGFwcG5leHVzLCBCSUQ6IDE4MDdmMDBkOGNiZDUxNzYsIEJXSDogMzAweDYwMCAtLT5cbjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9hLnB1Yi5uZXR3b3JrL2NvcmUvcHJlYmlkLXVuaXZlcnNhbC1jcmVhdGl2ZS5qc1wiPjwvc2NyaXB0PlxuPHNjcmlwdD5cbiAgdmFyIHVjVGFnRGF0YSA9IHt9O1xuICB1Y1RhZ0RhdGEuYWRTZXJ2ZXJEb21haW4gPSBcIlwiO1xuICB1Y1RhZ0RhdGEucHViVXJsID0gXCJodHRwczovL3d3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbS9uZXdzL3NlY3VyaXR5L2Vtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QvXCI7XG4gIHVjVGFnRGF0YS50YXJnZXRpbmdNYXAgPSB7XCJhbXpuYmlkXCI6W1wiMlwiXSxcImFtem5wXCI6W1wiMlwiXSxcImN1c3RvbV9iaWRkZXJfc2l6ZVwiOltcImFwcG5leHVzXzMwMHg2MDBcIl0sXCJmbG9vcnNfaG91clwiOltcIjFcIl0sXCJmbG9vcnNfaWRcIjpbXCI2NTk4M2ZcIl0sXCJmcmVlc3Rhcl9kb21haW5cIjpbXCJibGVlcGluZ2NvbXB1dGVyLmNvbVwiXSxcImZyZWVzdGFyX3BhdGhcIjpbXCIvbmV3cy9zZWN1cml0eS9lbW90ZXQtbWFsd2FyZS1pcy1iYWNrLWFuZC1yZWJ1aWxkaW5nLWl0cy1ib3RuZXQtdmlhLXRyaWNrYm90L1wiXSxcImZzX2FkX3Byb2R1Y3RcIjpbXCJiYW5uZXJcIl0sXCJmc19wbGFjZW1lbnRuYW1lXCI6W1wiYmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zXCJdLFwiZnNiaWRcIjpbXCIwXCJdLFwiZnNwYmdcIjpbXCJmcmVlc3RhclwiXSxcImZzcmViaWRcIjpbXCIwXCJdLFwiZnNyZWZyZXNoXCI6W1wiMFwiXSxcImhiX2FkaWRcIjpbXCIxODA3ZjAwZDhjYmQ1MTc2XCJdLFwiaGJfYmlkZGVyXCI6W1wiYXBwbmV4dXNcIl0sXCJoYl9mb3JtYXRcIjpbXCJiYW5uZXJcIl0sXCJoYl9wYlwiOltcIjAuOTFcIl0sXCJoYl9zaXplXCI6W1wiMzAweDYwMFwiXSxcInNlY3Rpb25cIjpbXCJuZXdzXCJdLFwidXNlci1hZ2VudFwiOltcIkNocm9tZVwiXX07XG4gIHVjVGFnRGF0YS5oYlBiID0gXCIwLjkxXCI7XG5cbiAgdHJ5IHtcbiAgICB1Y1RhZy5yZW5kZXJBZChkb2N1bWVudCwgdWNUYWdEYXRhKTtcbiAgfSBjYXRjaCAoZSkge1xuICAgIGNvbnNvbGUubG9nKGUpO1xuICB9XG48L3NjcmlwdD48IS0tIENyZWF0aXZlIDMyMzIzOTE5NyBzZXJ2ZWQgYnkgTWVtYmVyIDEwODggdmlhIEFwcE5leHVzIC0tPjxpbWcgc3JjPVwiaHR0cHM6Ly9ueTEtYmlkLmFkc3J2ci5vcmcvYmlkL2ZlZWRiYWNrL2FwcG5leHVzP3Q9MSZhbXA7aWlkPWE2YmIwYjlmLTM0MGItNGJkNC1iOTJhLTFmYzY1MWZjYmY0NiZhbXA7Y3JpZD04MzM0eGJ1YSZhbXA7d3A9Mi4zMzQ4NTgmYW1wO2FpZD02MzEwODg1NTQxMDk5NDA4MDg4JmFtcDt3cGM9VVNEJmFtcDtzZmU9MTNlMzk5ODUmYW1wO3B1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZhbXA7dGRpZD0mYW1wO3BpZD0zaThqYjhqJmFtcDthZz12cGprdnNtJmFtcDthZHY9bTRjcG5kaCZhbXA7c2lnPTFzRWRxZ3FzSnlkd0tUamZGZVpJYllGM1FjdllFSnFyT1NTSTg2WFNoU1hjLiZhbXA7YnA9Mi4zMzQ4NTc0NzY0MDgyMSZhbXA7Y2Y9MjcxNjMyOSZhbXA7ZnE9MCZhbXA7dGRfcz13d3cuYmxlZXBpbmdjb21wdXRlci5jb20mYW1wO3JjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmYW1wO21jYXQ9JmFtcDttc3RlPSZhbXA7bWZsZD00JmFtcDttc3NpPSZhbXA7bWZzaT0mYW1wO3Vob3c9MTY0JmFtcDthZ3NhPSZhbXA7cmd6PUgzQiZhbXA7c3ZidHRkPTEmYW1wO2R0PVBDJmFtcDtvc2Y9V2luZG93cyZhbXA7b3M9V2luZG93czEwJmFtcDticj1DaHJvbWUmYW1wO3JsYW5ncz1lbiZhbXA7bWxhbmc9JmFtcDtzdnBpZD03MTI1JmFtcDtkaWQ9MTI2NzU5NCZhbXA7cmN4dD1PdGhlciZhbXA7bGF0PTQ1LjQ5OTQwMCZhbXA7bG9uPS03My41NzAzMDAmYW1wO3RtcGM9LTcuMjUmYW1wO2RhaWQ9JmFtcDt2cD0wJmFtcDtvc2k9JmFtcDtvc3Y9JmFtcDttaz1Hb29nbGUmYW1wO21kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZhbXA7Yz1DZ1pEWVc1aFpHRVNCbEYxWldKbFl4b0FJZ2hOYjI1MGNtVmhiRGdDVUFGWUFvQUJBSWdCQVpBQkFBLi4mYW1wO2R1cj1Da2dLSVdOb1lYSm5aUzFoYkd4TmIyRjBWbWxsZDJGaWFXeHBkSGxVY21GamEybHVaeUlqQ0tYX19fX19fX19fX3dFU0RtMXZZWFF0Y21Wd2IzSjBhVzVuS2dZSXdJUTlHQXcuJmFtcDtkdXJzPXk2VkVNdyZhbXA7Y3JyZWxyPSZhbXA7YWRwdD1hbm9yJmFtcDtpcGw9YmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zL2JsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMyZhbXA7cGNtPTEmYW1wO3ZjPTMmYW1wO3NhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZhbXA7aWN0PVVua25vd24mYW1wO2F1Y3Q9MSZhbXA7aW09MSZhbXA7bWM9YWQwMzhmYjctNjMxZi00N2ZmLTg2ZmYtMmFmZDU0NzBkOWFmXCIgd2lkdGg9XCIxXCIgaGVpZ2h0PVwiMVwiIHN0eWxlPVwiZGlzcGxheTpub25lO1wiPjxpbnMgY2xhc3M9XCJkY21hZHNcIiBzdHlsZT1cImRpc3BsYXk6IGlubGluZS1ibG9jazsgd2lkdGg6IDMwMHB4OyBoZWlnaHQ6IDYwMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7XCIgZGF0YS1kY20tcGxhY2VtZW50PVwiTjE0NDYwMS4yODY0NTBBTU5FVC9CMjY3OTg5MTcuMzIwMTIzMzAyXCIgZGF0YS1kY20tcmVuZGVyaW5nLW1vZGU9XCJzY3JpcHRcIiBkYXRhLWRjbS1odHRwcy1vbmx5PVwiXCIgZGF0YS1kY20tZ2Rwci1hcHBsaWVzPVwiZ2Rwcj0wXCIgZGF0YS1kY20tZ2Rwci1jb25zZW50PVwiZ2Rwcl9jb25zZW50PVwiIGRhdGEtZGNtLWFkZHRsLWNvbnNlbnQ9XCJhZGR0bF9jb25zZW50PSR7QUREVExfQ09OU0VOVH1cIiBkYXRhLWRjbS1sdGQ9XCJmYWxzZVwiIGRhdGEtZGNtLXJlc2V0dGFibGUtZGV2aWNlLWlkPVwiXCIgZGF0YS1kY20tYXBwLWlkPVwiXCIgZGF0YS1kY20tY2xpY2stdHJhY2tlcj1cImh0dHA6Ly9pbnNpZ2h0LmFkc3J2ci5vcmcvdHJhY2svY2xrP3R0ZF9yPSZhbXA7aW1wPWE2YmIwYjlmLTM0MGItNGJkNC1iOTJhLTFmYzY1MWZjYmY0NiZhbXA7YWc9dnBqa3ZzbSZhbXA7c2ZlPTEzZTM5OTg1JmFtcDtzaWc9U0ZjQXRnQ3ZzNm9YUWpNZlZVeVRrTDBsbGJhempDVEwxaVh3T2diT1lyUS4mYW1wO2NyaWQ9ODMzNHhidWEmYW1wO2NmPTI3MTYzMjkmYW1wO2ZxPTAmYW1wO3Q9MSZhbXA7dGRfcz13d3cuYmxlZXBpbmdjb21wdXRlci5jb20mYW1wO3JjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmYW1wO21jYXQ9JmFtcDttc3RlPSZhbXA7bWZsZD00JmFtcDttc3NpPSZhbXA7bWZzaT0mYW1wO3N2PWFwcG5leHVzJmFtcDt1aG93PTE2NCZhbXA7YWdzYT0mYW1wO3dwPSR7UFJJQ0VfUEFJRH0mYW1wO3Jnej1IM0ImYW1wO2R0PVBDJmFtcDtvc2Y9V2luZG93cyZhbXA7b3M9V2luZG93czEwJmFtcDticj1DaHJvbWUmYW1wO3N2cGlkPTcxMjUmYW1wO3JsYW5ncz1lbiZhbXA7bWxhbmc9JmFtcDtkaWQ9MTI2NzU5NCZhbXA7cmN4dD1PdGhlciZhbXA7dG1wYz0tNy4yNSZhbXA7dnJ0ZD0mYW1wO29zaT0mYW1wO29zdj0mYW1wO2RhaWQ9JmFtcDtkbnI9MCZhbXA7dnBiPSZhbXA7Yz1DZ1pEWVc1aFpHRVNCbEYxWldKbFl4b0FJZ2hOYjI1MGNtVmhiRGdDVUFGWUFvQUJBSWdCQVpBQkFBLi4mYW1wO2R1cj1Da2dLSVdOb1lYSm5aUzFoYkd4TmIyRjBWbWxsZDJGaWFXeHBkSGxVY21GamEybHVaeUlqQ0tYX19fX19fX19fX3dFU0RtMXZZWFF0Y21Wd2IzSjBhVzVuS2dZSXdJUTlHQXcuJmFtcDtkdXJzPXk2VkVNdyZhbXA7Y3JyZWxyPSZhbXA7bnB0PSZhbXA7bWs9R29vZ2xlJmFtcDttZGw9Q2hyb21lJTIwLSUyMFdpbmRvd3MmYW1wO2FkcHQ9YW5vciZhbXA7aXBsPWJsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMy9ibGVlcGluZ2NvbXB1dGVyXzMwMHgyNTBfMzAweDYwMF8xNjB4NjAwX1JpZ2h0XzMmYW1wO3BjbT0xJmFtcDtpY3Q9VW5rbm93biZhbXA7c2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmFtcDthdWN0PTEmYW1wO3I9XCIgZGF0YS1kY20tcHJvY2Vzc2VkPVwieVwiPlxuICA8c2NyaXB0IHNyYz1cImh0dHBzOi8vZncuYWRzYWZlcHJvdGVjdGVkLmNvbS9yanNzL3d3dy5nb29nbGV0YWdzZXJ2aWNlcy5jb20vODc3OTU5LzU4NDk3MTQ3L2RjbS9kY21hZHMuanNcIj48L3NjcmlwdD48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBvbmxvYWQ9XCJfX0ludGVncmFsQVNFdmVudExvYWRIYW5kbGVyXzlhMGZiZGUzOWFlOGYxM2M1M2Q5YTBhZmYxZGVlZTE0ICZhbX&i=4-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
bwsP2K4FYxqQ_Pp-K6i99uOG9uCUxTLL8aynSNvIlBfP4J2Dkq3Gdw==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
426 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=A7JmFtcDsgX19JbnRlZ3JhbEFTRXZlbnRMb2FkSGFuZGxlcl85YTBmYmRlMzlhZThmMTNjNTNkOWEwYWZmMWRlZWUxNCgpXCIgc3JjPVwiaHR0cHM6Ly9mdy5hZHNhZmVwcm90ZWN0ZWQuY29tL3Jmdy93d3cuZ29vZ2xldGFnc2VydmljZXMuY29tLzg3Nzk1OS81ODQ5NzE0Ny9kY20vZGNtYWRzLmpzP2Fkc2FmZV91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuYmxlZXBpbmdjb21wdXRlci5jb20lMkZuZXdzJTJGc2VjdXJpdHklMkZlbW90ZXQtbWFsd2FyZS1pcy1iYWNrLWFuZC1yZWJ1aWxkaW5nLWl0cy1ib3RuZXQtdmlhLXRyaWNrYm90JTJGJmFtcDthZHNhZmVfdHlwZT1hYmRxJmFtcDthZHNhZmVfdXJsPWh0dHBzJTNBJTJGJTJGd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJTJGJmFtcDthZHNhZmVfdHlwZT1mJmFtcDthZHNhZmVfanNpbmZvPSxpZDo5YTBmYmRlMy05YWU4LWYxM2MtNTNkOS1hMGFmZjFkZWVlMTQsYzp2U00wdzgsc2w6b3V0T2ZWaWV3LGVtOnRydWUsZnI6dHJ1ZSx0aGQ6MSxtbjpqc3NlcnZlci1wcmltYXJ5LTg0Njg1NDk5Ni05ZnhwZyxyZzp2YSxwdDoxLTUtMTUsd2M6MC4wLjE2MDAuMTIwMCxhYzoxMDgyLjIzMjkuMzAwLjYwMCxhbTppLGNjOjEwODIuMjMyOS4zMDAuNjAwLHBpdjowLG9ic3Q6MCx0aDowLHJlYXM6cixicjp1LGFidjpuYSxhbjpuLG9hbTowLG5ibGQ6MCxtdGltOjMsZm06c1FHYU40aysxMTExJTdDMTExMiU3QzExMTMlN0MxMTE0JTdDMTExNSU3QzExMTYlN0MxMTE3JTdDMTExOCU3QzExMTklN0MxMTFhJTdDMTExYiU3QzExMWMlN0MxMTFkJTdDMTExZSU3QzExMWYlN0MxMiU3QzEzJTdDMTQlN0MxNSU3QzE2JTdDMTclN0MxOCU3QzE5MSU3QzFhJTdDMWIxJTdDMWMlN0MxZDElN0MxZTElN0MxZiU3QzFnJTdDMWglN0MxaTExJTdDMWkxMiU3QzFpMTMlN0MxaTE0JTdDMWkxNSU3QzFpMTYlN0MxaTE3JTdDMWkxOCU3QzFpMTklN0MxaTFhJTdDMWoxMSU3QzFrMSU3QzFrMiU3QzFsMSU3QzFtJTdDMW4xJTdDMW8xJTdDMXAxJTdDMXEqLjg3Nzk1OS01ODQ5NzE0NyU3QzFyJTdDMXMsaWRNYXA6MXEqLHBsOixybWVhczoxLHJlbmQ6MCxyZW5kZGV0OklNRy51cyxlczowLHNjOjEsaGE6MSxmaWY6MCxnbW5wOjAsZm9yOjAsYjExOjAsY25vZDoxLGdtOjAsdHQ6cmpzcyxldDo0MCxvaWQ6ZTllZjg0ODAtNTU2Yy0xMWVjLWJhZGUtNjY3NDQ2MWZiZTQ2LHY6MTkuOC4yNzAsc3A6MCxzdDowLGZ3bTowLHdyOjE2MDAuMTIwMCxzcjoxNjAwLjEyMDAsb3Y6MFwiIHJlZmVycmVycG9saWN5PVwibm8tcmVmZXJyZXItd2hlbi1kb3duZ3JhZGVcIj48L3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vd3d3Lmdvb2dsZXRhZ3NlcnZpY2VzLmNvbS9kY20vaW1wbF92ODEuanNcIj48L3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L2RkbS9hZGovTjE0NDYwMS4yODY0NTBBTU5FVC9CMjY3OTg5MTcuMzIwMTIzMzAyO2RjX3Zlcj04MS4yMzY7ZGNfZWlkPTQwMDA0MDAxO3N6PTMwMHg2MDA7dV9zZD0xO2dkcHI9MDtuZWw9MTtkY19hZGs9MjY4MjEwOTY1MztvcmQ9dXA5cGlzO2NsaWNrPWh0dHAlM0ElMkYlMkZpbnNpZ2h0LmFkc3J2ci5vcmclMkZ0cmFjayUyRmNsayUzRnR0ZF9yJTNEJTI2aW1wJTNEYTZiYjBiOWYtMzQwYi00YmQ0LWI5MmEtMWZjNjUxZmNiZjQ2JTI2YWclM0R2cGprdnNtJTI2c2ZlJTNEMTNlMzk5ODUlMjZzaWclM0RTRmNBdGdDdnM2b1hRak1mVlV5VGtMMGxsYmF6akNUTDFpWHdPZ2JPWXJRLiUyNmNyaWQlM0Q4MzM0eGJ1YSUyNmNmJTNEMjcxNjMyOSUyNmZxJTNEMCUyNnQlM0QxJTI2dGRfcyUzRHd3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbSUyNnJjYXRzJTNEMmR4JTJDb2JrJTJDamJhJTJDeXZiJTJDM2dzJTI2bWNhdCUzRCUyNm1zdGUlM0QlMjZtZmxkJTNENCUyNm1zc2klM0QlMjZtZnNpJTNEJTI2c3YlM0RhcHBuZXh1cyUyNnVob3clM0QxNjQlMjZhZ3NhJTNEJTI2d3AlM0QlMjQlN0JQUklDRV9QQUlEJTdEJTI2cmd6JTNESDNCJTI2ZHQlM0RQQyUyNm9zZiUzRFdpbmRvd3MlMjZvcyUzRFdpbmRvd3MxMCUyNmJyJTNEQ2hyb21lJTI2c3ZwaWQlM0Q3MTI1JTI2cmxhbmdzJTNEZW4lMjZtbGFuZyUzRCUyNmRpZCUzRDEyNjc1OTQlMjZyY3h0JTNET3RoZXIlMjZ0bXBjJTNELTcuMjUlMjZ2cnRkJTNEJTI2b3NpJTNEJTI2b3N2JTNEJTI2ZGFpZCUzRCUyNmRuciUzRDAlMjZ2cGIlM0QlMjZjJTNEQ2daRFlXNWhaR0VTQmxGMVpXSmxZeG9BSWdoTmIyNTBjbVZoYkRnQ1VBRllBb0FCQUlnQkFaQUJBQS4uJTI2ZHVyJTNEQ2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiUyNmR1cnMlM0R5NlZFTXclMjZjcnJlbHIlM0QlMjZucHQlM0QlMjZtayUzREdvb2dsZSUyNm1kbCUzRENocm9tZSUyNTIwLSUyNTIwV2luZG93cyUyNmFkcHQlM0Rhbm9yJTI2aXBsJTNEYmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zJTJGYmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zJTI2cGNtJTNEMSUyNmljdCUzRFVua25vd24lMjZzYWlkJTNENzQ4MDQ3NDQzMTA0NTIyMDA0MiUyNmF1Y3QlM0QxJTI2ciUzRDt1YWNoPSU1QiUyMiUyMiUyQyUyMiUyMiUyQyUyMiUyMiUyQyUyMiUyMiUyQyUyMiUyMiUyQyU1QiU1RCUyQ251bGwlMkNudWxsJTJDJTIyJTIyJTVEO2RjX3JmbD0xLGh0dHBzJTNBJTJGJTJGd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJTJGbmV3cyUyRnNlY3VyaXR5JTJGZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdCUyRiQwO3hkdD0wO2NybHQ9ZE5GSGVGNzBWQTtnY3NyPW07c3R0cj0xNjI7cHJjbD1zXCI%2BPC9zY3JpcHQ%2BPGRpdiBjbGFzcz1cIkdvb2dsZUFjdGl2ZVZpZXdFbGVtZW50XCIgaWQ9XCJEZmFWaXNpYmlsaXR5SWRlbnRpZmllcl8yMDEzOTAwMDM2XCIgYWN0aXZlX3ZpZXdfY2xhc3NfbmFtZT1cIkdvb2dsZUFjdGl2ZVZpZXdFbGVtZW50XCIgZGF0YS1nb29nbGUtYXYtY3huPVwiaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wY3MvYWN0aXZldmlldz94YWk9QUtBT2pzdFBJRlM1S1FpbVBQNjItY0FQSVFCMi1LT3I5LWx3ZkZ1eGpiUUxiUUgyU09tUTB3XzhnU0FYLVdUSk1MLTVQanZMenZVTGlOc1o5bWdzanFwSm9RY0dxRC1qT1FPODhWbyZhbXA7c2lnPUNnMEFyS0pTekkzUnl0ZmluTWVIRUFFXCIgZGF0YS1nb29nbGUtYXYtYWRrPVwiMjY4MjEwOTY1M1wiIGRhdGEtZ29vZ2xlLWF2LW1ldGFkYXRhPVwibGE9MCZhbXA7XCIgZGF0YS1nb29nbGUtYXYtb3ZlcnJpZGU9XCItMVwiIGRhdGEtZ29vZ2xlLWF2LWltbWVkaWF0ZT1cInRydWVcIiBkYXRhLWdvb2dsZS1hdi1haWQ9XCIwXCIgZGF0YS1nb29nbGUtYXYtbmFpZD1cIjFcIiBkYXRhLWdvb2dsZS1hdi1zbGlmdD1cIlwiIGRhdGEtZ29vZ2xlLWF2LWNwbWF2PVwiXCIgZGF0YS1nb29nbGUtYXYtYnRyPVwiXCIgZGF0YS1nb29nbGUtYXYtaXRwbD1cIjMyXCIgZGF0YS1nb29nbGUtYXYtcnM9XCI2XCIgZGF0YS1nb29nbGUtYXYtZG09XCIyXCIgZGF0YS1nb29nbGUtYXYtZmxhZ3M9XCJbJnF1b3Q7eCUyNzg0NDAnOWVmb3RtKCZhbXA7NzUzMzc0JTJiZWp2Zi8lMjc4NDQ%2BJzl3dXZiJCZhbXA7NTY1MzM%2BIT18dnFjKSEyNzM3OTQmYW1wOzxxcXZiLyU8MTczNTAyMCE9bmVodWAvITM2ND01MDUxITlhYmt7YSgkMTYwMjEwOjMmYW1wOzxjYm90ZisqMDE1MDAzNDolMmJlanZmLyU3MjsxNzYxMyE9ZWZkd2EqJzc2NDYzOzIxJD9lYmtwYiQmYW1wOzAzNjY3MTc%2BKj5iZ2lwZishMz03MTIzNjMlOWFpaHdjKSE3MjAyPDIxNyc5ZWZvdG0oJmFtcDsyMDA2MTs0OCZhbXA7PmBkb3BiLyU8MTcwNzIwMCE9OCgmYW1wOzIwMDU1NzU%2FJmFtcDs%2BYGRvcGJ%2BJnF1b3Q7XVwiIGRhdGEtY3JlYXRpdmUtbG9hZC1saXN0ZW5lcj1cIlwiPjxkaXYgY2xhc3M9XCJHb29nbGVDcmVhdGl2ZUNvbnRhaW5lckNsYXNzXCIgaWQ9XCJnY2NfaWhtc1lkbVNFNXFMb1B3UHVOdVV1QXNcIiBkYXRhLWNyZWF0aXZlLWxvYWQtbGlzdGVuZXI9XCJcIj48YSB0YXJnZXQ9XCJfYmxhbmtcIiBpZD1cImltZ19hbmNoX0NObl8yc1hFeV9RQ0Zab0ZpQWtkdUMwRnR3XCIgaHJlZj1cImh0dHBzOi8vYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldC9wY3MvY2xpY2s%2FeGFpPUFLQU9qc3UtalEzWkZJZVAybTNZcERGRDhNNDJIeEpldGVFWEhRUTZwcHZ6V3NUSGkxa0xtT0t4eFpvTzg2SGZBeldISXY3VjBMR3F5bGtvanJfSmxIdzZ2WWVVRTRmTFJoLV9hUG1LT2hpTk9xZFJYNjNidDdRWXNSX3VPWjlCR183amxqSjdTSHZPMVp0eFRrSjlYZzlnZ2E4cjI0Wjc2aF9YeVNTRSZhbXA7c2lnPUNnMEFyS0pTekpzbVZZT2RHU0E0JmFtcDtmYnNfYWVpZD1bZ3dfZmJzYWVpZF0mYW1wO3VybGZpeD0xJmFtcDthZHVybD1odHRwOi8vaW5zaWdodC5hZHNydnIub3JnL3RyYWNrL2NsayUzRnR0ZF9yJTNEJTI2aW1wJTNEYTZiYjBiOWYtMzQwYi00YmQ0LWI5MmEtMWZjNjUxZmNiZjQ2JTI2YWclM0R2cGprdnNtJTI2c2ZlJTNEMTNlMzk5ODUlMjZzaWclM0RTRmNBdGdDdnM2b1hRak1mVlV5VGtMMGxsYmF6akNUTDFpWHdPZ2JPWXJRLiUyNmNyaWQlM0Q4MzM0eGJ1YSUyNmNmJTNEMjcxNjMyOSUyNmZxJTNEMCUyNnQlM0QxJTI2dGRfcyUzRHd3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbSUyNnJjYXRzJTNEMmR4LG9iayxqYmEseXZiLDNncyUyNm1jYXQlM0QlMjZtc3RlJTNEJTI2bWZsZCUzRDQlMjZtc3NpJTNEJTI2bWZzaSUzRCUyNnN2JTNEYXBwbmV4dXMlMjZ1aG93JTNEMTY0JTI2YWdzYSUzRCUyNndwJTNEJTI0JTdCUFJJQ0VfUEFJRCU3RCUyNnJneiUzREgzQiUyNmR0JTNEUEMlMjZvc2YlM0RXaW5kb3dzJTI2b3MlM0RXaW5kb3dzMTAlMjZiciUzRENocm9tZSUyNnN2cGlkJTNENzEyNSUyNnJsYW5ncyUzRGVuJTI2bWxhbmclM0QlMjZkaWQlM0QxMjY3NTk0JTI2cmN4dCUzRE90aGVyJTI2dG1wYyUzRC03LjI1JTI2dnJ0ZCUzRCUyNm9zaSUzRCUyNm9zdiUzRCUyNmRhaWQlM0QlMjZkbnIlM0QwJTI2dnBiJTNEJTI2YyUzRENnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiUyNmR1ciUzRENrZ0tJV05vWVhKblpTMWhiR3hOYjJGMFZtbGxkMkZpYVd4cGRIbFVjbUZqYTJsdVp5SWpDS1hfX19fX19fX19fd0VTRG0xdllYUXRjbVZ3YjNKMGFXNW5LZ1lJd0lROUdBdy4lMjZkdXJzJTNEeTZWRU13JTI2Y3JyZWxyJTNEJTI2bnB0JTNEJTI2bWslM0RHb29nbGUlMjZtZGwlM0RDaHJvbWUlMjUyMC0lMjUyMFdpbmRvd3MlMjZhZHB0JTNEYW5vciUyNmlwbCUzRGJsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMy9ibGVlcGluZ2NvbXB1dGVyXzMwMHgyNTBfMzAweDYwMF8xNjB4NjAwX1JpZ2h0XzMlMjZwY20lM0QxJTI2aWN0JTNEVW5rbm93biUyNnNhaWQlM0Q3NDgwNDc0NDMxMDQ1MjIwMDQyJTI2YXVjdCUzRDElMjZyJTNEaHR0cHM6Ly9lbGV2YXRlLm1hc3RlcmNhcmQuY29tL2JlbmVmaXQvcHJvZHVjdC8xNjY3ODcvYXBwbGUtbXVzaWMtY2FuYWRhJTI1M0ZhYyUyNTNEYXBwbGUtbXVzaWMtY2FuYWRhXCI%2BPGltZyBzcmM9XCJodHRwczovL3MwLjJtZG4ubmV0Lzg0OTcwNzcvTUNfQU1fSURFT05fMzAweDYwMF9lbi5wbmdcIiBhbHQ9XCJBZHZlcnRpc2VtZW50XCIgYm9yZGVyPVwiMFwiIHdpZHRoPVwiMzAwXCIgaGVpZ2h0PVwiNjAwXCIgc3R5bGU9XCJkaXNwbGF5OmJsb2NrXCI%2BPC9hPjxzY3JpcHQgZGF0YS1qYz1cIjc0XCIgZGF0YS1qYy12ZXJzaW9uPVwicjIwMjExMjAxXCIgZGF0YS1qY3AtYS1pZD1cImltZ19hbmNoX0NObl8yc1hFeV9RQ0Zab0ZpQWtkdUMwRnR3XCIgZGF0YS1qY3AtZm9yLXN1cmUtb3Blbi1icm93c2VyPVwiZmFsc2VcIiBkYXRhLWpjcC1mb3Itc3VyZS1vcGVuLWN1&i=5-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
4UPM1LlX1eNIYrgTe4DeWuVhJOjEMJJrz7qgV4wRpsAv1duVwYtx7g==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=c3RvbS10YWJzPVwiZmFsc2VcIj4oZnVuY3Rpb24oKXsvKiAgQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAgKi8gdmFyIGU9dGhpc3x8c2VsZjt2YXIgZj0vXig%2FOig%2FOmh0dHBzP3xtYWlsdG98ZnRwKTp8W146Lz8jXSooPzpbLz8jXXwkKSkvaTsvKiAgU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAgKi8gZnVuY3Rpb24gZyhiKXt2YXIgZD1iLmN1cnJlbnRUYXJnZXQsYT1kLnF1ZXJ5U2VsZWN0b3IoXCJpbWdbYWx0XVwiKTtpZihhKXt2YXIgYz1kLmhyZWY7dmFyIHI9K01hdGgucm91bmQoYi5jbGllbnRYLWEub2Zmc2V0TGVmdCk7Yj0rTWF0aC5yb3VuZChiLmNsaWVudFktYS5vZmZzZXRUb3ApO2E9K2Eud2lkdGgrXCJ4XCIrICthLmhlaWdodDt2YXIgaD0vXihodHRwcz86W146P10rWy9dcGNzWy9dY2xpY2tbXi9dKz8pKD86Jm54W14mXSsmbnlbXiZdKyZkaW1bXiZdKyk%2FKCZhZHVybD0uKikvLmV4ZWMoYyk7Yz1oP2hbMV0rKFwiJm54PVwiK3IrXCImbnk9XCIrYitcIiZkaW09XCIrYSkraFsyXTpjO2YudGVzdChjKSYmKGQuaHJlZj1jKX19O3ZhciBrLGw9ZG9jdW1lbnQuY3VycmVudFNjcmlwdDtrPShsPXZvaWQgMD09PWw%2FbnVsbDpsKSYmXCI3NFwiPT09bC5nZXRBdHRyaWJ1dGUoXCJkYXRhLWpjXCIpP2w6ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignW2RhdGEtamM9XCI3NFwiXScpO2lmKG51bGw9PWspdGhyb3cgRXJyb3IoXCJKU0Mgbm90IGZvdW5kIDc0XCIpO2Zvcih2YXIgbT17fSxuPWsuYXR0cmlidXRlcyxwPW4ubGVuZ3RoLTE7MDw9cDtwLS0pe3ZhciBxPW5bcF0ubmFtZTswPT09cS5pbmRleE9mKFwiZGF0YS1qY3AtXCIpJiYobVtxLnN1YnN0cmluZyg5KV09bltwXS52YWx1ZSl9IChmdW5jdGlvbihiKXt2YXIgZD1kb2N1bWVudC5nZXRFbGVtZW50QnlJZChiW1wiYS1pZFwiXSk7ZC5hZGRFdmVudExpc3RlbmVyKFwibW91c2Vkb3duXCIsZyk7dmFyIGE9XCJ0cnVlXCI9PT1iW1wiZm9yLXN1cmUtb3Blbi1jdXN0b20tdGFic1wiXTsoXCJ0cnVlXCI9PT1iW1wiZm9yLXN1cmUtb3Blbi1icm93c2VyXCJdfHxhKSYmZC5hZGRFdmVudExpc3RlbmVyKFwiY2xpY2tcIixmdW5jdGlvbihjKXt2b2lkIDAhPWUuQUZNQV9Db21tdW5pY2F0b3ImJnZvaWQgMCE9ZS5BRk1BX0NvbW11bmljYXRvci5zZW5kTWVzc2FnZSYmKGMucHJldmVudERlZmF1bHQoKSxlLkFGTUFfQ29tbXVuaWNhdG9yLnNlbmRNZXNzYWdlKFwib3BlblwiLHthOlwiYXBwXCIsdTpjLmN1cnJlbnRUYXJnZXQuaHJlZixzeXN0ZW1fYnJvd3NlcjohMCx1c2VfZmlyc3RfcGFja2FnZTohMCx1c2VfcnVubmluZ19wcm9jZXNzOiEwLHVzZV9jdXN0b21fdGFiczphfSkpfSl9KShtKTt9KS5jYWxsKHRoaXMpOzwvc2NyaXB0PjwvZGl2PjwvZGl2PlxuPC9pbnM%2BXG48c3BhbiBpZD1cInRlLWNsZWFyYWRzLWpzLXRyYWRlZGVzazAxY29udDFcIj48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBzcmM9XCJodHRwczovL2Nob2ljZXMudHJ1c3RlLmNvbS9jYT9waWQ9dHJhZGVkZXNrMDEmYW1wO2FpZD10cmFkZWRlc2swMSZhbXA7Y2lkPWF3MndsczdfdnBqa3ZzbV84MzM0eGJ1YSZhbXA7Yz10cmFkZWRlc2swMWNvbnQxJmFtcDtqcz1wbXcwJmFtcDt3PTMwMCZhbXA7aD02MDAmYW1wO3NpZD0wXCI%2BPC9zY3JpcHQ%2BPC9zcGFuPjxpbWcgc3JjPVwiXCIgd2lkdGg9XCIxXCIgaGVpZ2h0PVwiMVwiIHN0eWxlPVwiZGlzcGxheTogbm9uZTtcIj48aW1nIHNyYz1cIlwiIHdpZHRoPVwiMVwiIGhlaWdodD1cIjFcIiBzdHlsZT1cImRpc3BsYXk6IG5vbmU7XCI%2BPGRpdiBpZD1cIm1vYXRQeERpdjg4NzkzOVwiIHN0eWxlPVwid2lkdGg6IDBweDsgaGVpZ2h0OiAwcHg7IHBvc2l0aW9uOiBhYnNvbHV0ZTsgdG9wOiAwcHg7IGxlZnQ6IDBweDtcIj48ZGl2IHN0eWxlPVwicG9zaXRpb246IGFic29sdXRlOyB3aWR0aDogN3B4OyBoZWlnaHQ6IDEzcHg7IHotaW5kZXg6IC05OTk5OyBib3JkZXItc3R5bGU6IG5vbmU7bGVmdDogMHB4OyB0b3A6IDBweDtcIiBpZD1cIk1vYXRQeElPUFQzXzE3OTM2MDQ0XCI%2BPC9kaXY%2BPC9kaXY%2BPGRpdiBpZD1cIm1vYXRQeERpdjQ0MDk2NVwiIHN0eWxlPVwid2lkdGg6IDBweDsgaGVpZ2h0OiAwcHg7IHBvc2l0aW9uOiBhYnNvbHV0ZTsgdG9wOiAwcHg7IGxlZnQ6IDBweDtcIj48ZGl2IHN0eWxlPVwicG9zaXRpb246IGFic29sdXRlOyB3aWR0aDogN3B4OyBoZWlnaHQ6IDEzcHg7IHotaW5kZXg6IC05OTk5OyBib3JkZXItc3R5bGU6IG5vbmU7IGxlZnQ6IDI5M3B4OyB0b3A6IDBweDtcIiBpZD1cIk1vYXRQeElPUFQzXzEwNDkxNTlcIj48L2Rpdj48L2Rpdj48ZGl2IGlkPVwibW9hdFB4RGl2NDA2ODk4XCIgc3R5bGU9XCJ3aWR0aDogMHB4OyBoZWlnaHQ6IDBweDsgcG9zaXRpb246IGFic29sdXRlOyB0b3A6IDBweDsgbGVmdDogMHB4O1wiPjxkaXYgc3R5bGU9XCJwb3NpdGlvbjogYWJzb2x1dGU7IHdpZHRoOiA3cHg7IGhlaWdodDogMTNweDsgei1pbmRleDogLTk5OTk7IGJvcmRlci1zdHlsZTogbm9uZTsgbGVmdDogMHB4OyB0b3A6IDU4N3B4O1wiIGlkPVwiTW9hdFB4SU9QVDNfODk4MzIxNjBcIj48L2Rpdj48L2Rpdj48ZGl2IGlkPVwibW9hdFB4RGl2NjQ4NjUzXCIgc3R5bGU9XCJ3aWR0aDogMHB4OyBoZWlnaHQ6IDBweDsgcG9zaXRpb246IGFic29sdXRlOyB0b3A6IDBweDsgbGVmdDogMHB4O1wiPjxkaXYgc3R5bGU9XCJwb3NpdGlvbjogYWJzb2x1dGU7IHdpZHRoOiA3cHg7IGhlaWdodDogMTNweDsgei1pbmRleDogLTk5OTk7IGJvcmRlci1zdHlsZTogbm9uZTsgbGVmdDogMjkycHg7IHRvcDogNTg2cHg7XCIgaWQ9XCJNb2F0UHhJT1BUM185OTYyNjQxMVwiPjwvZGl2PjwvZGl2PjxkaXYgc3R5bGU9XCJkaXNwbGF5OiBub25lO1wiPjxub3NjcmlwdCBjbGFzcz1cIk1PQVQtdGhldHJhZGVkZXNrdjI3NTg3NDU2ODc0OD9tb2F0Q2xpZW50TGV2ZWwxPW00Y3BuZGgmYW1wO21vYXRDbGllbnRMZXZlbDI9YXcyd2xzNyZhbXA7bW9hdENsaWVudExldmVsMz12cGprdnNtJmFtcDttb2F0Q2xpZW50U2xpY2VyMT13d3cuYmxlZXBpbmdjb21wdXRlci5jb20mYW1wO3pNb2F0SW1wcmVzc2lvbklkPWE2YmIwYjlmLTM0MGItNGJkNC1iOTJhLTFmYzY1MWZjYmY0NiZhbXA7ek1vYXRDYWNoZWJ1c3Rlcj00MjI1MzkmYW1wO3pNb2F0UGFydG5lcklEPTNpOGpiOGomYW1wO3pNb2F0Vmlld1R5cGU9MCZhbXA7ek1vYXRDcmVhdGl2ZT04MzM0eGJ1YSZhbXA7ek1vYXREZWFsSUQ9MTI2NzU5NCZhbXA7ek1vYXRTdXBwbHlWZW5kb3I9YXBwbmV4dXMmYW1wO3pNb2F0U2l0ZT13d3cuYmxlZXBpbmdjb21wdXRlci5jb20mYW1wO3pNb2F0UHVibGlzaGVySUQ9NzEyNSZhbXA7bW9hdENsaWVudExldmVsND0tXCI%2BPC9ub3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vei5tb2F0YWRzLmNvbS90aGV0cmFkZWRlc2t2Mjc1ODc0NTY4NzQ4L21vYXRhZC5qcyNtb2F0Q2xpZW50TGV2ZWwxPW00Y3BuZGgmYW1wO21vYXRDbGllbnRMZXZlbDI9YXcyd2xzNyZhbXA7bW9hdENsaWVudExldmVsMz12cGprdnNtJmFtcDttb2F0Q2xpZW50U2xpY2VyMT13d3cuYmxlZXBpbmdjb21wdXRlci5jb20mYW1wO3pNb2F0SW1wcmVzc2lvbklkPWE2YmIwYjlmLTM0MGItNGJkNC1iOTJhLTFmYzY1MWZjYmY0NiZhbXA7ek1vYXRDYWNoZWJ1c3Rlcj00MjI1MzkmYW1wO3pNb2F0UGFydG5lcklEPTNpOGpiOGomYW1wO3pNb2F0Vmlld1R5cGU9MCZhbXA7ek1vYXRDcmVhdGl2ZT04MzM0eGJ1YSZhbXA7ek1vYXREZWFsSUQ9MTI2NzU5NCZhbXA7ek1vYXRTdXBwbHlWZW5kb3I9YXBwbmV4dXMmYW1wO3pNb2F0U2l0ZT13d3cuYmxlZXBpbmdjb21wdXRlci5jb20mYW1wO3pNb2F0UHVibGlzaGVySUQ9NzEyNSZhbXA7bW9hdENsaWVudExldmVsND1odHRwJTNBJTJGJTJGaW5zaWdodC5hZHNydnIub3JnJTJGZW5kdXNlciUyRnBpZSUyRiUzRnBpZSUzRDIwJTI2dmV0JTNEVklFV0FCSUxJVFlfRVZFTlRfVFlQRSUyNnJ0YiUzRGREMHhKbWxwWkQxaE5tSmlNR0k1Wmkwek5EQmlMVFJpWkRRdFlqa3lZUzB4Wm1NMk5URm1ZMkptTkRZbVkzSnBaRDA0TXpNMGVHSjFZU1ozY0Qwa2UxQlNTVU5GWDFCQlNVUjlKbUZwWkQwMk16RXdPRGcxTlRReE1EazVOREE0TURnNEpuZHdZejFWVTBRbWMyWmxQVEV6WlRNNU9UZzFKbkIxYVdROU9EazROek13TkRFNU1qYzNOVFE1TlRJNU55WndhV1E5TTJrNGFtSTRhaVpoWnoxMmNHcHJkbk50Sm1Ga2RqMXROR053Ym1Sb0ptSndQVEl1TXpNME9EVTNORGMyTkRBNE1qRW1ZMlk5TWpjeE5qTXlPU1ptY1Qwd0puUmtYM005ZDNkM0xtSnNaV1Z3YVc1blkyOXRjSFYwWlhJdVkyOXRKbkpqWVhSelBUSmtlQ3h2WW1zc2FtSmhMSGwyWWl3elozTW1iV05oZEQwbWJYTjBaVDBtYldac1pEMDBKbTF6YzJrOUptMW1jMms5Sm5Wb2IzYzlNVFkwSm1GbmMyRTlKbkpuZWoxSU0wSW1jM1ppZEhSa1BURW1aSFE5VUVNbWIzTm1QVmRwYm1SdmQzTW1iM005VjJsdVpHOTNjekV3Sm1KeVBVTm9jbTl0WlNaeWJHRnVaM005Wlc0bWJXeGhibWM5Sm5OMmNHbGtQVGN4TWpVbVpHbGtQVEV5TmpjMU9UUW1jbU40ZEQxUGRHaGxjaVpzWVhROU5EVXVORGs1TkRBd0pteHZiajB0TnpNdU5UY3dNekF3Sm5SdGNHTTlMVGN1TWpVbVpHRnBaRDBtZG5BOU1DWnZjMms5Sm05emRqMG1iV3M5UjI5dloyeGxKbTFrYkQxRGFISnZiV1VsTWpBdEpUSXdWMmx1Wkc5M2N5WmpQVU5uV2tSWlZ6Vm9Xa2RGVTBKc1JqRmFWMHBzV1hodlFVbG5hRTVpTWpVd1kyMVdhR0pFWjBOVlFVWlpRVzlCUWtGSlowSkJXa0ZDUVVFdUxpWmtkWEk5UTJ0blMwbFhUbTlaV0VwdVdsTXhhR0pIZUU1aU1rWXdWbTFzYkdReVJtbGhWM2h3WkVoc1ZXTnRSbXBoTW14MVdubEpha05MV0Y5ZlgxOWZYMTlmWDE5M1JWTkViVEYyV1ZoUmRHTnRWbmRpTTBvd1lWYzFia3RuV1VsM1NWRTVSMEYzTGlaamNuSmxiSEk5Sm1Ga2NIUTlZVzV2Y2lacGNHdzlZbXhsWlhCcGJtZGpiMjF3ZFhSbGNsOHpNREI0TWpVd1h6TXdNSGcyTURCZk1UWXdlRFl3TUY5U2FXZG9kRjh6TDJKc1pXVndhVzVuWTI5dGNIVjBaWEpmTXpBd2VESTFNRjh6TURCNE5qQXdYekUyTUhnMk1EQmZVbWxuYUhSZk15WndZMjA5TVNaMll6MHpKbk5oYVdROU56UTRNRFEzTkRRek1UQTBOVEl5TURBME1pWnBZM1E5Vlc1cmJtOTNiaVpoZFdOMFBURW1hVzA5TVNadFl6MWhaREF6T0daaU55MDJNekZtTFRRM1ptWXRPRFptWmkweVlXWmtOVFEzTUdRNVlXWW1jM1k5WVhCd2JtVjRkWE0uXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjwvZGl2PjxkaXYgc3R5bGU9XCJkaXNwbGF5OiBub25lO1wiPjwvZGl2PjxpZnJhbWUgc3JjPVwiaHR0cHM6Ly9hY2RuLmFkbnhzLmNvbS9kbXAvYXN5bmNfdXNlcnN5bmMuaHRtbD9nZHByPTAmYW1wO3NlbGxlcl9pZD03MTI1JmFtcDtwdWJfaWQ9ODYzMTM3XCIgd2lkdGg9XCIxXCIgaGVpZ2h0PVwiMVwiIGZyYW1lYm9yZGVyPVwiMFwiIHNjcm9sbGluZz1cIm5vXCIgbWFyZ2luaGVpZ2h0PVwiMFwiIG1hcmdpbndpZHRoPVwiMFwiIHRvcG1hcmdpbj1cIjBcIiBsZWZ0bWFyZ2luPVwiMFwiIHN0eWxlPVwicG9zaXRpb246YWJzb2x1dGU7b3ZlcmZsb3c6aGlkZGVuO2NsaXA6cmVjdCgwIDAgMCAwKTtoZWlnaHQ6MXB4O3dpZHRoOjFweDttYXJnaW46LTFweDtwYWRkaW5nOjA7Ym9yZGVyOjA7XCI%2BPC9pZnJhbWU%2BPHNjcmlwdD50cnkgeyFmdW5jdGlvbigpe2Z1bmN0aW9uIGUoZSx0KXtyZXR1cm5cImZ1bmN0aW9uXCI9PXR5cGVvZiBfX2FuX29ial9leHRlbmRfdGh1bms%2FX19hbl9vYmpfZXh0ZW5kX3RodW5rKGUsdCk6ZX1mdW5jdGlvbiB0KGUsdCl7XCJmdW5jdGlvblwiPT10eXBlb2YgX19hbl9lcnJfdGh1bmsmJl9fYW5fZXJyX3RodW5rKGUsdCl9ZnVuY3Rpb24gbihlLHQpe2lmKFwiZnVuY3Rpb25cIj09dHlwZW9mIF9fYW5fcmVkaXJlY3RfdGh1bmspX19hbl9yZWRpcmVjdF90aHVuayhlKTtlbHNle3ZhciBuPW5hdm&i=6-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
RgALhQtVsjzrSKB6lKCTw-p8iljpF3HtHjfXwZqqYTfzMXbdnfPaLw==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
425 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=lnYXRvci5jb25uZWN0aW9uO25hdmlnYXRvci5fX2FuX2Nvbm5lY3Rpb24mJihuPW5hdmlnYXRvci5fX2FuX2Nvbm5lY3Rpb24pLHdpbmRvdz09d2luZG93LnRvcCYmbiYmbi5kb3dubGlua01heDw9LjExNSYmXCJmdW5jdGlvblwiPT10eXBlb2YgSFRNTElGcmFtZUVsZW1lbnQmJkhUTUxJRnJhbWVFbGVtZW50LnByb3RvdHlwZS5oYXNPd25Qcm9wZXJ0eShcInNyY2RvY1wiKT8od2luZG93Ll9fYW5fcmVzaXplPWZ1bmN0aW9uKGUsdCxuKXt2YXIgcj1lLmZyYW1lRWxlbWVudDtyJiZcIl9fYW5faWZcIj09ci5nZXRBdHRyaWJ1dGUoXCJuYW1lXCIpJiYodCYmKHIuc3R5bGUud2lkdGg9dCtcInB4XCIpLG4mJihyLnN0eWxlLmhlaWdodD1uK1wicHhcIikpfSxkb2N1bWVudC53cml0ZSgnPGlmcmFtZSBuYW1lPVwiX19hbl9pZlwiIHN0eWxlPVwid2lkdGg6MDtoZWlnaHQ6MFwiIHNyY2RvYz1cIjxzY3JpcHQgdHlwZT1cXCd0ZXh0L2phdmFzY3JpcHRcXCcgc3JjPVxcJycrZStcIiZcIit0LmJkZmlmK1wiPTEnPjwvc2NcIiksZG9jdW1lbnQud3JpdGUoJ3JpcHQ%2BXCIgZnJhbWVib3JkZXI9XCIwXCIgc2Nyb2xsaW5nPVwibm9cIiBtYXJnaW5oZWlnaHQ9MCBtYXJnaW53aWR0aD0wIHRvcG1hcmdpbj1cIjBcIiBsZWZ0bWFyZ2luPVwiMFwiIGFsbG93dHJhbnNwYXJlbmN5PVwidHJ1ZVwiPjwvaWZyYW1lPicpKTpkb2N1bWVudC53cml0ZSgnPHNjcmlwdCBsYW5ndWFnZT1cImphdmFzY3JpcHRcIiBzcmM9XCInK2UrJ1wiPjwvc2NyJysnaXB0PicpfX07dmFyIHI9ZnVuY3Rpb24oZSl7dGhpcy5yZFBhcmFtcz1lfTtyLnByb3RvdHlwZT17Y29uc3RydWN0b3I6cix3YWxrQW5jZXN0b3JzOmZ1bmN0aW9uKGUpe3RyeXtpZighd2luZG93LmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucylyZXR1cm47Zm9yKHZhciB0PTAsbj13aW5kb3cubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zLmxlbmd0aDtuPnQ7dCsrKWUuY2FsbChudWxsLHdpbmRvdy5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnNbdF0sdCl9Y2F0Y2gocil7XCJ1bmRlZmluZWRcIiE9dHlwZW9mIGNvbnNvbGV9cmV0dXJuW119LHdhbGtVcFdpbmRvd3M6ZnVuY3Rpb24oZSl7dmFyIHQsbj1bXTtkbyB0cnl7dD10P3QucGFyZW50OndpbmRvdyxlLmNhbGwobnVsbCx0LG4pfWNhdGNoKHIpe3JldHVyblwidW5kZWZpbmVkXCIhPXR5cGVvZiBjb25zb2xlLG4ucHVzaCh7cmVmZXJyZXI6bnVsbCxsb2NhdGlvbjpudWxsLGlzVG9wOiExfSksbn13aGlsZSh0IT13aW5kb3cudG9wKTtyZXR1cm4gbn0sZ2V0UHViVXJsU3RhY2s6ZnVuY3Rpb24oZSl7dmFyIG4scj1bXSxvPW51bGwsaT1udWxsLGE9bnVsbCxjPW51bGwsZD1udWxsLHM9bnVsbCx1PW51bGw7Zm9yKG49ZS5sZW5ndGgtMTtuPj0wO24tLSl7dHJ5e2E9ZVtuXS5sb2NhdGlvbn1jYXRjaChsKXtcInVuZGVmaW5lZFwiIT10eXBlb2YgY29uc29sZSx0KGwsXCJBblJETW9kdWxlOjpnZXRQdWJVcmxTdGFjazo6IGxvY2F0aW9uXCIpfWlmKGEpaT1lbmNvZGVVUklDb21wb25lbnQoYSksci5wdXNoKGkpLHV8fCh1PWkpO2Vsc2UgaWYoMCE9PW4pe2M9ZVtuLTFdO3RyeXtkPWMucmVmZXJyZXIscz1jLmFuY2VzdG9yfWNhdGNoKGwpe1widW5kZWZpbmVkXCIhPXR5cGVvZiBjb25zb2xlLHQobCxcIkFuUkRNb2R1bGU6OmdldFB1YlVybFN0YWNrOjogcHJldkZyYW1lXCIpfWQ%2FKGk9ZW5jb2RlVVJJQ29tcG9uZW50KGQpLHIucHVzaChpKSx1fHwodT1pKSk6cz8oaT1lbmNvZGVVUklDb21wb25lbnQocyksci5wdXNoKGkpLHV8fCh1PWkpKTpyLnB1c2gobyl9ZWxzZSByLnB1c2gobyl9cmV0dXJue3N0YWNrOnIsZGV0ZWN0VXJsOnV9fSxnZXRMZXZlbHM6ZnVuY3Rpb24oKXt2YXIgZT10aGlzLndhbGtVcFdpbmRvd3MoZnVuY3Rpb24oZSxuKXt0cnl7bi5wdXNoKHtyZWZlcnJlcjplLmRvY3VtZW50LnJlZmVycmVyfHxudWxsLGxvY2F0aW9uOmUubG9jYXRpb24uaHJlZnx8bnVsbCxpc1RvcDplPT13aW5kb3cudG9wfSl9Y2F0Y2gocil7bi5wdXNoKHtyZWZlcnJlcjpudWxsLGxvY2F0aW9uOm51bGwsaXNUb3A6ZT09d2luZG93LnRvcH0pLFwidW5kZWZpbmVkXCIhPXR5cGVvZiBjb25zb2xlLHQocixcIkFuUkRNb2R1bGU6OmdldExldmVsc1wiKX19KTtyZXR1cm4gdGhpcy53YWxrQW5jZXN0b3JzKGZ1bmN0aW9uKHQsbil7ZVtuXS5hbmNlc3Rvcj10fSksZX0sZ2V0UmVmZXJlckluZm86ZnVuY3Rpb24oKXt2YXIgZT1cIlwiO3RyeXt2YXIgbj10aGlzLmdldExldmVscygpLHI9bi5sZW5ndGgtMSxvPW51bGwhPT1uW3JdLmxvY2F0aW9ufHxyPjAmJm51bGwhPT1uW3ItMV0ucmVmZXJyZXIsaT10aGlzLmdldFB1YlVybFN0YWNrKG4pO2U9dGhpcy5yZFBhcmFtcy5yZFJlZitcIj1cIitpLmRldGVjdFVybCtcIiZcIit0aGlzLnJkUGFyYW1zLnJkVG9wK1wiPVwiK28rXCImXCIrdGhpcy5yZFBhcmFtcy5yZElmcytcIj1cIityK1wiJlwiK3RoaXMucmRQYXJhbXMucmRTdGsrXCI9XCIraS5zdGFjaytcIiZcIitkZWNvZGVVUkkodGhpcy5yZFBhcmFtcy5yZFFzKX1jYXRjaChhKXtlPVwiXCIsXCJ1bmRlZmluZWRcIiE9dHlwZW9mIGNvbnNvbGUsdChhLFwiQW5SRE1vZHVsZTo6Z2V0UmVmZXJlckluZm9cIil9cmV0dXJuIGV9fTt2YXIgbz1mdW5jdGlvbihuKXt2YXIgbz1cIlwiO3RyeXtuPWUobiwwKTt2YXIgaT1lKG5ldyByKG4pLDEpO3JldHVybiBpLmdldFJlZmVyZXJJbmZvKCl9Y2F0Y2goYSl7bz1cIlwiLFwidW5kZWZpbmVkXCIhPXR5cGVvZiBjb25zb2xlLHQoYSxcIkFuUkRNb2R1bGU6OmV4ZWN1dGVSRFwiKX1yZXR1cm4gb307O3ZhciBjPVwiaHR0cHM6Ly9ueW0xLWliLmFkbnhzLmNvbS9yZF9sb2c%2FYW5fYXVkaXQ9MCZyZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbSUyRm5ld3MlMkZzZWN1cml0eSUyRmVtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QlMkYmZT13cVRfM1FLZVBQQk1IaDRBQUFNQTFnQUZBUWlGczdDTkJoRDB2YkRJa195ZnUyTVlnYjJNMXI2eDFOeDhLallKQkpEYXhNbXRBa0FSYmtiZE9WcVc3VDhaQUFBQUFDbGNIa0FoYmtiZE9WcVc3VDhwQkpBSkpOQXhBQUFBWUlfQzhUOHdxWmJNQmpqVk4wREFDRWhTVUpiNmtKb0JXTDY5UTJBQWFNaVVnQUY0djgwRmdBRUJpZ0VEVlZORWtnVUc5Rk1CbUFIWUJhQUJXcWdCQWJBQkFMZ0JBY0FCQmNnQkF0QUJBTmdCQU9BQkFQQUJBTmdDbmtqZ0FwM19XLW9DYldoMGRIQnpPaTh2ZDNkM0xtSnNaV1Z3YVc1blkyOXRjSFYwWlhJdVkyOXRMMjVsZDNNdmMyVmpkWEpwZEhrdlpXMXZkR1YwTFcxaGJIZGhjbVV0YVhNdFltRmpheTFoYm1RdGNtVmlkV2xzWkdsdVp5MXBkSE10WW05MGJtVjBMWFpwWVMxMGNtbGphMkp2ZENfeUFyOEdDZ3RmWDFSVVJGOURURXRmWHhLdkJpWnBiWEE5TkRJNVpEQTVaR0l0TURVek5TMDBPR1ppTFdGbFpXWXRORFE1WWpGbU1EWTNNVEpsSm1GblBYWndhbXQyYzIwbWMyWmxQVEV6WlRNNU9UZzFKbk5wWnoxamNFaHFOM1p5WVVaNE5WbFhSVjlGV0dSb1ZFdDBRalpqVDBNMk5rbEtaemMyUTNoYWJUbG5SMk5KTGlaamNtbGtQV3gzTW5FeWREZDVKbU5tUFRJM01UWXpNamttWm5FOU1DWjBQVEVtZEdSZmN6MTNkM2N1WW14bFpYQnBiaklUQWZUVEFTWnlZMkYwY3oweVpIZ3NiMkpyTEdwaVlTeDVkbUlzTTJkekptMWpZWFE5Sm0xemRHVTlKbTFtYkdROU5DWnRjM05wUFNadFpuTnBQU1p6ZGoxaGNIQnVaWGgxY3laMWFHOTNQVEUyTkNaaFozTmhQU1ozY0Qwa2UxQlNTVU5GWDFCQlNVUjlKbkpuZWoxSU0wSW1aSFE5VUVNbWIzTm1QVmRwYm1SdmQzTW1iM005VjJsdVpHOTNjekV3Sm1KeVBVTm9jbTl0WlNaemRuQnBaRDAzTVRJMUpuSnNZVzVuY3oxbGJpWnRiR0Z1WnowbVpHbGtQVEV5TmpjMU9UUW1jbU40ZEQxUGRHaGxjaVowYlhCalBTMDNMakkxSm5aeWRHUTlKbTl6YVQwbWIzTjJQU1prWVdsa1BTWmtibkk5TUNaMmNHSTlKbU05UTJkYVJGbFhOV2hhUjBWVFFteEdNVnBYU214WmVHOUJTV2RvVG1JeU5UQmpiVlpvWWtSblExVkJSbGxCYjBGQ1FVbG5Ra0ZhUVVKQlFTNHVKbVIxY2oxRGEyZExTVmRPYjFsWVNtNWFVekZvWWtkNFRtSXlSakJXYld4c1pESkdhV0ZYZUhCa1NHeFZZMjFHYW1FeWJIVmFlVWxxUTB0WVgxOWZYMTlmWDE5ZlgzZEZVMFJ0TVhaWldGRjBZMjFXZDJJelNqQmhWelZ1UzJkWlNYZEpVVGxIUVhjdUptUjFjbk05ZVRaV1JVMTNKbU55Y21Wc2NqMG1ibkIwUFNadGF6MUhiMjluYkdVbWJXUnNQVU5vY205dFpTVXlNQzBsTWpCWGFTbGFPR0ZrY0hROVlXNXZjaVpwY0d3OVlqb1BBeWhmTnpJNGVEa3dYemszTUJFSE9ESTFNRjh6TWpCNE5UQmZRVlJHTDhJeUFFd21jR050UFRFbWFXTjBQVlZ1YTI1dmQyNG1jeUY1WkRjME9EQTBOelEwTXpFd05EVXlNakF3TkRJbVlYVmpkRDB4YVVNTUpTVlVWR1ZER0NVbEVxOEdKbW4tUXdQLVF3UC1Rd1AtUXdQLVF3UC1Rd1AtUXdQLVF3UC1Rd1AtUXdQLVF3UC1Rd082UXdQSUZRb1JUMVpGVWxKSlJFVmZUVVZVUVVSQlZFRVNBUElDRHdvTFRrbEZURk5GVGw5VVFVY1NBUElDRFFvSlRGVkRTVVJmR1JBVVNWTlFUMVJmRFJBTWdRRUtEbUdMTUZCSldFVk1YMGhGUVVRU2IyanRVM3h1ZVRFdFltbGtMbUZrYzNKMmNpNXZjbWN2WW1sa0wyWmxaV1JpWVdOckw5RUxCRDkwZ1FNVWFXUTlOREk1aGdZSElHTnlhV1E5YkhjeWNjVzlHSGR3UGZJQ25RY3VoUUFjVkVGSlRCS0tCeWFGU1BCWU1UWTNNRFUyTkRZeU16QTRNVGczT0RreUpuZHdZejFWVTBRbWMyWmxQVEV6WlRNNU9UZzFKbkIxYVdROU9EazROek13TkRFNU1qYzNOVFE1TlRJNU55WjBaR2xrUFNad2FXUTlNMms0YW1JNGFpWmhaejEyY0dybGhfQnBZV1IyUFcwMFkzQnVaR2dtYzJsblBURjNkRzlZVURsdWVtaGFjMmRPTkhCdGRpMUpjWE5aY1ZrNFJXdE9RVVJhV2tKYVExbElXRnBLYzNaTkxpWmljRDB5TGpNek5EZzFOelEzTmpRd09ESXhKbU5tUFRJM01UWXpNamttWm5FOU1DWjBaRjl6UFhkM2QxS2NDT2FKQndCMU5uMEg4V3dnYzNaaWRIUmtQVEVtb25VSENISnNZVFpxQndSemRpRXNJRGN4TWpVbVpHbGtQVXAxQjNCc1lYUTlORFV1TkRrNU5EQXdKbXh2YmowdE56TXVOVGN3TXpBd0p2MlNBR1Fod1NRbWRuQTlNQ1p2YzJrOTZaZUt4UWItcVFmLXFRZnVxUWNBWWY2QkI5cUJCd3gyWXowelpub0hMcDhIQUdIbGh2Q0xKbWx0UFRFbWJXTTlZV1F3TXpobVlqY3ROak14WmkwME4yWm1MVGcyWm1ZdE1tRm1aRFUwTnpCa09XRm04Z0tsRWdvVVZrbEZWMEZDU1V4SlZGbGZWRkpCUTB0SlRrY1NqQkk4Ym05elkzSnBjSFFnWTJ4aGMzTTlJazFQUVZRdGRHaGxkSEpoWkdWa1pYTnJkakkzTlRnM05EVTJPRGMwT0Q5dGIyRjBRMnhwWlc1MFRHVjJaV3d4UFcxdGdBeGhiWEE3T2gwQUlESTlZWGN5ZDJ4ek4wNGRBQVF6UFhYR01qb0FHRk5zYVdObGNqRm1kUU1CTHp4NlRXOWhkRWx0Y0hKbGMzTnBiMjVKbXJ3RUZUdEVRMkZqYUdWaWRYTjBaWEk5TVRJM01qVTRHUndnVUdGeWRHNWxja2xFbVhJRWJYQUpjaVJXYVdWM1ZIbHdaVDB3R1M4Y1EzSmxZWFJwZG1XNUZCVXZGRVJsWVd4SlJIV0VGUmd3VTNWd2NHeDVWbVZ1Wkc5eVBiR0dIUjhJYVhSbGl2OEFHRkIxWW14cGMyZ0ZxbVh3QVdBNmdnRWdORDB0SWo0OEwyNXZLZVFFUGp3SkNCUWdjM0pqUFNMUktBUjZMZ0UySkdGa2N5NWpiMjB2ZEdoYS13RUFMd2ttREM1cWN5TUJDbElGQWpvWkFGa0JPaGtBT2YwWkdZTDVBZHIxQVFVM1N2RUJCUmhHN1FFRkZ6M3BCUkJHNVFFRkZ6cmhBUVVVVnQwQkNSdHkyUUVGSTBMVkFUa2dHRXhsZG1Wc05EMGh0andsTTBFbE1rWWxNa1pwYm5OcFoyaDBfZU04SlRKR1pXNWtkWE5sY2lVeVJuQnBaUUVvQURNRkNUQXpSREl3SlRJMmRtVjBKVE5FTGc0RThIbEZWa1ZPVkY5VVdWQkZKVEkyY25SaUpUTkVaRVF3ZUVwdGJIQmFSREF3VFdwc2EwMUViR3RaYVRCM1RsUk5NVXhVVVRSYWJVbDBXVmRXYkZwcE1EQk9SR3hwVFZkWmQwNXFZM2hOYlZWdFdUTktjRnBFTVhOa2VrcDRUVzVSTTJWVFdqTmpSREJyWlRGQ1UxTlZUa1pZTVVKQ1UxVlNPVXB0UmdGZzhGZ3pUVlJa&i=7-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
epAfhzNYQGT4-6KZ7Pct-1r7Afc1flA2PMkjQCYLl40_0xVmudXlHA==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
425 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=TTAxRVZUSk9SRmw1VFhwQk5FMVVaek5QUkd0NVNtNWtkMWw2TVZaVk1GRnRZekphYkZCVVJYcGFWRTAxVDFSbk1VcHVRakZoVjFFNVQwUnJORTU2VFhkT1JFVTFUV3BqTTA1VVVUVk9WRWsxVG5sYWR3RWc5R3dFVFRKck5HRnRTVFJoYVZwb1dub3hNbU5IY0hKa2JrNTBTbTFHYTJScU1YUk9SMDUzWW0xU2IwcHRTbmRRVkVsMVRYcE5NRTlFVlROT1JHTXlUa1JCTkUxcVJXMVpNbGs1VFdwamVFNXFUWGxQVTFwdFkxUXdkMHB1VW10WU0wMDVaRE5rTTB4dFNuTmFWMVozWVZjMWJsa3lPWFJqU0ZZd1dsaEpkVmt5T1hSS2JrcHFXVmhTZWxCVVNtdGxRM2gyV1cxemMyRnRTbWhNU0d3eVdXbDNlbG96VFcxaVYwNW9aRVF3YldKWVRqQmFWREJ0WWxkYWMxcEVNREJLYlRGNll6SnJPVXB0TVcxak1tczVTbTVXYjJJell6bE5WRmt3U20xR2JtTXlSVGxLYmtwdVpXb3hTVTB3U1cxak0xcHBaRWhTYTFCVVJXMWFTRkU1VlVWTmJXSXpUbTFRVm1Sd1ltMVNkbVF6VFcxaU0wMDVWakpzZFZwSE9UTmpla1YzU20xS2VWQlZUbTlqYlRsMFdsTmFlV0pIUm5WYU0wMDVXbGMwYldKWGVHaGliV001U201T01tTkhiR3RRVkdONFRXcFZiVnBIYkd0UVZFVjVUbXBqTVU5VVVXMWpiVTQwWkVReFVHUkhhR3hqYVZweldWaFJPVTVFVlhWT1JHczFUa1JCZDBwdGVIWmlhakIwVG5wTmRVNVVZM2ROZWtGM1NtNVNkR05IVFRsTVZHTjFUV3BWYlZwSFJuQmFSREJ0Wkc1Qk9VMURXblpqTW1zNVNtMDVlbVJxTUcxaVYzTTVVakk1ZGxveWVHeEtiVEZyWWtReFJHRklTblppVjFWc1RXcEJkRXBVU1hkV01teDFXa2M1TTJONVdtcFFWVTV1VjJ0U1dsWjZWbTlYYTJSR1ZUQktjMUpxUm1GV01IQnpWMWhvZGxGVmJHNWhSVFZwVFdwVmQxa3lNVmRoUjBwRldqQk9WbEZWV2xwUlZ6bENVV3RHU2xvd1NrSlhhMFpEVVZWRmRVeHBXbXRrV0VrNVVUSjBibE13YkZoVWJUbGFWMFZ3ZFZkc1RYaGhSMHBJWlVVMWFVMXJXWGRXYlRGellrZFJlVkp0YkdoV00yaDNXa1ZvYzFaWFRuUlNiWEJvVFcxNE1WZHViRXBoYTA1TVYwWTVabGd4T1daWU1UbG1XREU1TTFKV1RrVmlWRVl5VjFab1VtUkhUblJXYm1ScFRUQnZkMWxXWXpGaWEzUnVWMVZzTTFOV1JUVlNNRVl6VEdsYWFtTnVTbXhpU0VrNVNtMUdhMk5JVVRsWlZ6VjJZMmxhY0dOSGR6bFpiWGhzV2xoQ2NHSnRaR3BpTWpGM1pGaFNiR05zT0ROTmFtZzBUMVJDWms5VVkzZGxSR3QzV0hwck0wMUlaM2xPVkVKbVRYcEpkMlZFVlhkWU1FWlZVbWs1YVdKSFZteGpSMngxV2pKT2RtSllRakZrUjFaNVdIcGplVTlJWnpWTlJqZzFUbnBDTkU5VVFtWlBWR04zWlVSSk1VMUdPSHBOYWtJMFRsUkNabEZXVWtkS2JrSnFZbFF3ZUVwdVdtcFFWRTF0WXpKR2NGcEVNRE5PUkdkM1RrUmpNRTVFVFhoTlJGRXhUV3BKZDAxRVVYbEtiV3hxWkVReFZtSnRkSFZpTTJSMVNtMUdNVmt6VVRsTlUxcHdZbFF3ZUVwdE1XcFFWMFpyVFVSTk5GcHRTVE5NVkZsNlRWZFpkRTVFWkcxYWFUQTBUbTFhYlV4VVNtaGFiVkV4VGtSamQxcEViR2hhYVZwNlpHb3hhR05JUW5WYVdHZ3hZM2N1TGlJZ2RIbHdaVDBpZEdWNGRDOXFZWFpoYzJOeWFYQjBJajQ4TDNOamNtbHdkRDd5QWhVS0VWSkZSa1ZTVWtWU1gxUlNRVU5MU1U1SEVnRHlBaFVLQzBOQlEwaEZRbFZUVkVWU0VnWTJPVGd3TkRIeUFpQUtCRk5KVkVVU0dIZDNkeTQtZmhIaFR4enlBb2NCQ2haZlh3NmtEVVJUU1ZSRlgxZEpWRWhmVUVGVVNGOWZFbTFlNGhNc0pUSm1ibVYzY3lVeVpuTmxGdmtVRUNVeVptVnQ2dnNVSENVeVp2SUNFQW9NQ1lvd1ZFUkpSRjlmRWdEeUFod0tFUWtUR0ZCQlVsUk9SVklGR0RBSE0yazRhbUk0YXZJQ0hRb1ZQaDhBUEVsT1ZGOWZFZ1F5TURZMThnSWZDaFFKSUJ4QlJGWkZVbFJKVXhGQ0dwWU5FUElDSWdvWVNpSUFDVVVZQmpNME9UY3pNd0ZuQUJJSkpSeERRVTFRUVVsSFRnbUhHajRLQ1BJQ0lURkRIU0FKUXh3SE1UazRNekV6TkIzS0dFRkVSMUpQVlZBSlF4cGtDZ0ZERGNvWkh3bENMQWd4TURFeE5EWXhNZklDSGhXSEdGSkZRVlJKVmtVRlJBQUlIdTBPQWMwdHl4MGhEVVl3TWpFd09UUTNOVGJ5QWhvS0VBbk5HRUZFUms5U1RVRWhMd1FHTnhLN0V3anlBaUF4TVR4VFZWQlFURmxXUlU1RVQxSmZYeElJSGdjS0lRMHRNaklqQUFsbkVBRTM4Z0k4RVVNZ1NVMVFVa1ZUVTBsUEtTOEFKSTZfRHdqeUFoUVJueHhEUVZSRlIwOVNXVWtKQUJnUl9CUkVSVlpKUTBVT0RnZ2dYMThTQWxCRDhnSVpNVHNBVGhxY0VBaFFRMThsR2dBQUhVNEpOeEVYQ0NBS0d5a0VMbWdJRkZCU1QwWkpUQUZYR0FFdzhnSVdDZ3NKSXdCTUpTSUFCeHFURGdqeUFoaFJwZ3hNVDA1SElSc2VudzRCaWdBUENUUVFRMDlWVGxRRnV4Z0dRMkZ1WVdSaElUY0FFelljQUJCRlRrTmZYeGtnQ0JnS0Rna2dGRkpGUjBsUFRnRWJGRkYxWldKbFkwRTdUWDhOR3cwNkVSOElFUW9OQ1RvUVRVVlVVazhwTHdBV0VZb1VXa2xRUTA5RUFkVU1BMGd6UWlILURZY1JHUWxOQ1IwVjJ3QkREb1lOS0Y4U0NFMXZiblJ5WldGc0FZUk5OZ1ViQ1RVZEh3UVdDbTJvR0ZSU1ZWTlVSVk1sYVNGSEFCa1Ixd3hFUlVGTUJSWUFCeHIwRHd6eUFoc0tUYThVVEVsTlNWUmZIdllOQkY5ZkJUb0lJZ29kQ2RjeDF5eEpUa0ZRVUY5UFVGUmZUMVZCdFFGZkNDUUtHUWtsSkZCU1NWWkJWRVZEVDA0QlJ3QlVDV29zYW1aemVtUXdNX0lDS1FvYUhTY0VRMWt0U1MwYU9BdDBjbUZrWldSbGMyc3dNZklDSkJHV2FGVk9TVmhmVkVsTlJWTlVRVTFRWDE4U0NqRTJNemcyTmpnMk4yWDBEWjlJUkVOUFgwMUJVRkJKVGtkU1ZVeEZYMDFCUXpHR0ZlRkpmaGhQVTBaQlRVbE1RZElFQVRKQllpMVRHRXhCVGtkVlFVY2hwUWdDWlc1aHh3M1ZKRkpGVGtSRlVrbE9SMThCMkFSRldBSDJLQVZQZEdobGN2SUNJd29mQ2RNc1ExVlRWRTlOUWtsRVJFVlNOVVFsQUFRQThsa2NERWRGVGxJQllRQUFJWGROQXhoUVZVSk1TVk5JclJRQUJBNmxEVUhFclRNc1IwUlFVbDlCVUZCTVNVVlRMWk1BSDNFM0JSd01RMDlPVXc2YUN3UlRWQVdqcGJBQUdqRTlNcFlBQURGdUhRQUFNbTRkQUFBekFSM3dkWUFEQUlnREFaQURBSmdERjZBREFhb0RBTUFEckFMSUF3RFlBX3Z2R09BREFPZ0RBUGdEQVlBRUFKSUVEUzkxZEM5Mk15OXdjbVZpYVdTWUJBQ2lCQTR6Tnk0eE1qQXVNakExTGpFNE1xZ0VBTElFRHdnQUVBRVkyQVVnV2lnQU1BQTRBcmdFQU1BRUFNZ0VBTm9FQWdnQjRBUUI4QVFTU3h4VWlBVUJtQVVBb0FYSzdkN3V5ZnYtNTJmQUJRREpCUTZYSEJ3QUFQQV8wZ1VKQ1FrTThFa0FBTmdGQWVBRkFlb0ZGd29OWm5OZllXUmZjSEp2WkhWamRCSUdZbUZ1Ym1WeThBV29BX29GQkFnQUVBQ1FCZ0NZQmdDaUJnNDNNVEkxSTA1WlRUSTZOVEkzT2JnR0FNRUdBQVZRTFBBXzBBYkUwQUhhQmhZS0VBVVJIUUh3VWhBQUdBRGdCZ0h5Qm5JSWlxOU5FbXhCYUVWTU9Xc3dRVUZCUVVSQlFXdERRbEZGU1hoS2FtNUNlRVJ2YVhKVlEwZEtRMkZyUVUxblFubG5RVkZOTmtwdlVXUkpOVXBEYUVJeFEwaE1WbWxtUzFoRkFUd0pBUlJJWjBGblVVVUpEQUVCWkVsblFrRktRVUpCU205Q1FXZG5RWUFIQVlnSEFLQUhBYW9IMGY0RXVnY2hURXdBR0FBZ0FEQUFPTElFUUFESUI3X05CZElIRFMwYkJFbEFBUjRJMmdjR0FmdE1HQURnQndEcUJ3SUlBUEFIMnY4WWlnZ0NFQUEuJnM9OGQ2MjkzZDAyYWViZDRmYTgwNTdkYmMxZGNhNGNiOGFhM2Y5MDdjYlwiO2MrPVwiJlwiK28oe3JkUmVmOlwiYmRyZWZcIixyZFRvcDpcImJkdG9wXCIscmRJZnM6XCJiZGlmc1wiLHJkU3RrOlwiYnN0a1wiLHJkUXM6XCJcIn0pLG4oYyx7YmRmaWY6XCJiZGZpZlwifSl9KCk7fSBjYXRjaCAoZSkgeyB9PC9zY3JpcHQ%2BPHNjcmlwdCBsYW5ndWFnZT1cImphdmFzY3JpcHRcIiBzcmM9XCJodHRwczovL255bTEtaWIuYWRueHMuY29tL3JkX2xvZz9hbl9hdWRpdD0wJmFtcDtyZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbSUyRm5ld3MlMkZzZWN1cml0eSUyRmVtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QlMkYmYW1wO2U9d3FUXzNRS2VQUEJNSGg0QUFBTUExZ0FGQVFpRnM3Q05CaEQwdmJESWtfeWZ1Mk1ZZ2IyTTFyNngxTng4S2pZSkJKRGF4TW10QWtBUmJrYmRPVnFXN1Q4WkFBQUFBQ2xjSGtBaGJrYmRPVnFXN1Q4cEJKQUpKTkF4QUFBQVlJX0M4VDh3cVpiTUJqalZOMERBQ0VoU1VKYjZrSm9CV0w2OVEyQUFhTWlVZ0FGNHY4MEZnQUVCaWdFRFZWTkVrZ1VHOUZNQm1BSFlCYUFCV3FnQkFiQUJBTGdCQWNBQkJjZ0JBdEFCQU5nQkFPQUJBUEFCQU5nQ25ramdBcDNfVy1vQ2JXaDBkSEJ6T2k4dmQzZDNMbUpzWldWd2FXNW5ZMjl0Y0hWMFpYSXVZMjl0TDI1bGQzTXZjMlZqZFhKcGRIa3ZaVzF2ZEdWMExXMWhiSGRoY21VdGFYTXRZbUZqYXkxaGJtUXRjbVZpZFdsc1pHbHVaeTFwZEhNdFltOTBibVYwTFhacFlTMTBjbWxqYTJKdmRDX3lBcjhHQ2d0ZlgxUlVSRjlEVEV0Zlh4S3ZCaVpwYlhBOU5ESTVaREE1WkdJdE1EVXpOUzAwT0daaUxXRmxaV1l0TkRRNVlqRm1NRFkzTVRKbEptRm5QWFp3YW10MmMyMG1jMlpsUFRFelpUTTVPVGcxSm5OcFp6MWpjRWhxTjNaeVlVWjROVmxYUlY5RldHUm9WRXQwUWpaalQwTTJOa2xLWnpjMlEzaGFiVGxuUjJOSkxpWmpjbWxrUFd4M01uRXlkRGQ1Sm1ObVBUSTNNVFl6TWprbVpuRTlNQ1owUFRFbWRHUmZjejEzZDNjdVlteGxaWEJwYmpJVEFmVFRBU1p5WTJGMGN6MHlaSGdzYjJKckxHcGlZU3g1ZG1Jc00yZHpKbTFqWVhROUptMXpkR1U5Sm0xbWJHUTlOQ1p0YzNOcFBTWnRabk5wUFNaemRqMWhjSEJ1WlhoMWN5WjFhRzkzUFRFMk5DWmhaM05oUFNaM2NEMGtlMUJTU1VORlgxQkJTVVI5Sm5KbmVqMUlNMEltWkhROVVFTW1iM05tUFZkcGJtUnZkM01tYjNNOVYybHVaRzkzY3pFd0ptSnlQVU5vY205dFpTWnpkbkJwWkQwM01USTFKbkpzWVc1bmN6MWxiaVp0YkdGdVp6MG1aR2xrUFRFeU5qYzFPVFFtY21ONGREMVBkR2hsY2laMGJYQmpQUzAzTGpJMUpuWnlkR1E5Sm05emFUMG1iM04yUFNaa1lXbGtQU1prYm5JOU1DWjJjR0k5Sm1NOVEyZGFSRmxYTldoYVIwVlRRbXhHTVZwWFNteFplRzlCU1dkb1RtSXlOVEJqYlZab1lrUm5RMVZCUmxsQmIwRkNRVWxuUWtGYVFVSkJRUzR1Sm1SMWNqMURhMmRMU1ZkT2IxbFlTbTVhVXpGb1lrZDRUbUl5UmpCV2JXeHNaREpHYVdGWGVIQmtTR3hWWTIxR2FtRXliSFZhZVVscVEwdFlYMTlmWDE5ZlgxOWZYM2RGVTBSdE1YWlpXRkYwWTIxV2QySXpTakJoVnpWdVMyZFpTWGRKVVRsSFFYY3VKbVIxY25NOWVUWldSVTEzSm1OeWNtVnNjajBtYm5CMFBTWnRhejFIYjI5bmJHVW1iV1JzUFVOb2NtOXRaU1V5TUMwbE1qQlhhU2xhT0dGa2NIUTlZVzV2Y2lacGNHdzlZam9QQXloZk56STRlRGt3WHprM01CRUhPREkxTUY4ek1qQjROVEJmUVZSR0w4SXlBRXdtY0dOdFBURW1hV04wUFZWdWEyNXZkMjRtY3lGNVpEYzBPREEwTnpRME16RXdORFV5TWpBd05ESW1ZWFZqZEQweGFVTU1KU1ZVVkdWREdDVWxFcThHSm1uLVF3UC1Rd1AtUXdQLVF3UC1Rd1AtUXdQLVF3UC1Rd1AtUXdQLVF3UC1Rd1AtUXdPNlF3UElGUW9SVDFaRlVsSkpSRVZmVFVWVVFVUkJWRUVTQVBJQ0R3b0xUa2xGVEZORlRsOVVRVWNTQVBJQ0RRb0pURlZEU1VSZkdSQVVTVk5RVDFSZkRSQU1nUUVLRG1HTE1GQkpXRVZNWDBoRlFVUVNiMmp0VTN4dWVURXRZbWxrTG1Ga2MzSjJjaTV2Y21jdlltbGtMMlpsWldSaVlXTnJMOUVMQkQ5MGdRTVVhV1E5TkRJNWhnWUhJR055YVdROWJIY3ljY1c5R0hkd1BmSUNuUWN1aFFBY1ZFRkpUQktLQnlhRlNQQllNVFkzTURVMk5EWXlNekE0TVRnM09Ea3lKbmR3WXoxVlUwUW1jMlpsUFRFelpUTTVPVGcxSm5CMWFXUTlPRGs0TnpNd05ERTVNamMzTlRRNU5USTVOeVowWkdsa1BTWndhV1E5TTJrNGFtSTRhaVpoWnoxMmNHcmxoX0JwWVdSMlBXMDBZM0J1WkdnbWMybG5QVEYzZEc5WVVEbHVlbWhhYzJkT05IQnRkaTFKY1hOWmNWazRSV3RPUVVSYVdrSmFRMWxJV0ZwS2MzWk5MaVppY0QweUxqTXpORGcxTnpRM05qUXdPREl4Sm1ObVBUSTNNVFl6TWprbVpuRTlNQ1owWkY5elBYZDNkMUtjQ09hSkJ3QjFObjBIOFd3Z2MzWmlkSFJrUFRFbW9uVUhDSEpzWVRacUJ3UnpkaU&i=8-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
1t3k1jqHV5EO3Vb3gHQ7lb7em0r3zUBSr6Ea-gHv_HQ1GGafOxeTlw==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=VzSURjeE1qVW1aR2xrUFVwMUIzQnNZWFE5TkRVdU5EazVOREF3Sm14dmJqMHROek11TlRjd016QXdKdjJTQUdRaHdTUW1kbkE5TUNadmMyazk2WmVLeFFiLXFRZi1xUWZ1cVFjQVlmNkJCOXFCQnd4Mll6MHpabm9ITHA4SEFHSGxodkNMSm1sdFBURW1iV005WVdRd016aG1ZamN0TmpNeFppMDBOMlptTFRnMlptWXRNbUZtWkRVME56QmtPV0ZtOGdLbEVnb1VWa2xGVjBGQ1NVeEpWRmxmVkZKQlEwdEpUa2NTakJJOGJtOXpZM0pwY0hRZ1kyeGhjM005SWsxUFFWUXRkR2hsZEhKaFpHVmtaWE5yZGpJM05UZzNORFUyT0RjME9EOXRiMkYwUTJ4cFpXNTBUR1YyWld3eFBXMXRnQXhoYlhBN09oMEFJREk5WVhjeWQyeHpOMDRkQUFRelBYWEdNam9BR0ZOc2FXTmxjakZtZFFNQkx6eDZUVzloZEVsdGNISmxjM05wYjI1Sm1yd0VGVHRFUTJGamFHVmlkWE4wWlhJOU1USTNNalU0R1J3Z1VHRnlkRzVsY2tsRW1YSUViWEFKY2lSV2FXVjNWSGx3WlQwd0dTOGNRM0psWVhScGRtVzVGQlV2RkVSbFlXeEpSSFdFRlJnd1UzVndjR3g1Vm1WdVpHOXlQYkdHSFI4SWFYUmxpdjhBR0ZCMVlteHBjMmdGcW1Yd0FXQTZnZ0VnTkQwdElqNDhMMjV2S2VRRVBqd0pDQlFnYzNKalBTTFJLQVI2TGdFMkpHRmtjeTVqYjIwdmRHaGEtd0VBTHdrbURDNXFjeU1CQ2xJRkFqb1pBRmtCT2hrQU9mMFpHWUw1QWRyMUFRVTNTdkVCQlJoRzdRRUZGejNwQlJCRzVRRUZGenJoQVFVVVZ0MEJDUnR5MlFFRkkwTFZBVGtnR0V4bGRtVnNORDBodGp3bE0wRWxNa1lsTWtacGJuTnBaMmgwX2VNOEpUSkdaVzVrZFhObGNpVXlSbkJwWlFFb0FETUZDVEF6UkRJd0pUSTJkbVYwSlRORUxnNEU4SGxGVmtWT1ZGOVVXVkJGSlRJMmNuUmlKVE5FWkVRd2VFcHRiSEJhUkRBd1RXcHNhMDFFYkd0WmFUQjNUbFJOTVV4VVVUUmFiVWwwV1ZkV2JGcHBNREJPUkd4cFRWZFpkMDVxWTNoTmJWVnRXVE5LY0ZwRU1YTmtla3A0VFc1Uk0yVlRXak5qUkRCclpURkNVMU5WVGtaWU1VSkNVMVZTT1VwdFJnRmc4Rmd6VFZSWk0wMUVWVEpPUkZsNVRYcEJORTFVWnpOUFJHdDVTbTVrZDFsNk1WWlZNRkZ0WXpKYWJGQlVSWHBhVkUwMVQxUm5NVXB1UWpGaFYxRTVUMFJyTkU1NlRYZE9SRVUxVFdwak0wNVVVVFZPVkVrMVRubGFkd0VnOUd3RVRUSnJOR0Z0U1RSaGFWcG9Xbm94TW1OSGNISmtiazUwU20xR2EyUnFNWFJPUjA1M1ltMVNiMHB0U25kUVZFbDFUWHBOTUU5RVZUTk9SR015VGtSQk5FMXFSVzFaTWxrNVRXcGplRTVxVFhsUFUxcHRZMVF3ZDBwdVVtdFlNMDA1WkROa00weHRTbk5hVjFaM1lWYzFibGt5T1hSalNGWXdXbGhKZFZreU9YUktia3BxV1ZoU2VsQlVTbXRsUTNoMldXMXpjMkZ0U21oTVNHd3lXV2wzZWxvelRXMWlWMDVvWkVRd2JXSllUakJhVkRCdFlsZGFjMXBFTURCS2JURjZZekpyT1VwdE1XMWpNbXM1U201V2IySXpZemxOVkZrd1NtMUdibU15UlRsS2JrcHVaV294U1Uwd1NXMWpNMXBwWkVoU2ExQlVSVzFhU0ZFNVZVVk5iV0l6VG0xUVZtUndZbTFTZG1RelRXMWlNMDA1VmpKc2RWcEhPVE5qZWtWM1NtMUtlVkJWVG05amJUbDBXbE5hZVdKSFJuVmFNMDA1V2xjMGJXSlhlR2hpYldNNVNtNU9NbU5IYkd0UVZHTjRUV3BWYlZwSGJHdFFWRVY1VG1wak1VOVVVVzFqYlU0MFpFUXhVR1JIYUd4amFWcHpXVmhST1U1RVZYVk9SR3MxVGtSQmQwcHRlSFppYWpCMFRucE5kVTVVWTNkTmVrRjNTbTVTZEdOSFRUbE1WR04xVFdwVmJWcEhSbkJhUkRCdFpHNUJPVTFEV25aak1tczVTbTA1ZW1ScU1HMWlWM001VWpJNWRsb3llR3hLYlRGcllrUXhSR0ZJU25aaVYxVnNUV3BCZEVwVVNYZFdNbXgxV2tjNU0yTjVXbXBRVlU1dVYydFNXbFo2Vm05WGEyUkdWVEJLYzFKcVJtRldNSEJ6VjFob2RsRlZiRzVoUlRWcFRXcFZkMWt5TVZkaFIwcEZXakJPVmxGVldscFJWemxDVVd0R1Nsb3dTa0pYYTBaRFVWVkZkVXhwV210a1dFazVVVEowYmxNd2JGaFViVGxhVjBWd2RWZHNUWGhoUjBwSVpVVTFhVTFyV1hkV2JURnpZa2RSZVZKdGJHaFdNMmgzV2tWb2MxWlhUblJTYlhCb1RXMTRNVmR1YkVwaGEwNU1WMFk1WmxneE9XWllNVGxtV0RFNU0xSldUa1ZpVkVZeVYxWm9VbVJIVG5SV2JtUnBUVEJ2ZDFsV1l6RmlhM1J1VjFWc00xTldSVFZTTUVZelRHbGFhbU51U214aVNFazVTbTFHYTJOSVVUbFpWelYyWTJsYWNHTkhkemxaYlhoc1dsaENjR0p0WkdwaU1qRjNaRmhTYkdOc09ETk5hbWcwVDFSQ1prOVVZM2RsUkd0M1dIcHJNMDFJWjNsT1ZFSm1UWHBKZDJWRVZYZFlNRVpWVW1rNWFXSkhWbXhqUjJ4MVdqSk9kbUpZUWpGa1IxWjVXSHBqZVU5SVp6Vk5SamcxVG5wQ05FOVVRbVpQVkdOM1pVUkpNVTFHT0hwTmFrSTBUbFJDWmxGV1VrZEtia0pxWWxRd2VFcHVXbXBRVkUxdFl6SkdjRnBFTUROT1JHZDNUa1JqTUU1RVRYaE5SRkV4VFdwSmQwMUVVWGxLYld4cVpFUXhWbUp0ZEhWaU0yUjFTbTFHTVZrelVUbE5VMXB3WWxRd2VFcHRNV3BRVjBaclRVUk5ORnB0U1ROTVZGbDZUVmRaZEU1RVpHMWFhVEEwVG0xYWJVeFVTbWhhYlZFeFRrUmpkMXBFYkdoYWFWcDZaR294YUdOSVFuVmFXR2d4WTNjdUxpSWdkSGx3WlQwaWRHVjRkQzlxWVhaaGMyTnlhWEIwSWo0OEwzTmpjbWx3ZEQ3eUFoVUtFVkpGUmtWU1VrVlNYMVJTUVVOTFNVNUhFZ0R5QWhVS0MwTkJRMGhGUWxWVFZFVlNFZ1kyT1Rnd05ESHlBaUFLQkZOSlZFVVNHSGQzZHk0LWZoSGhUeHp5QW9jQkNoWmZYdzZrRFVSVFNWUkZYMWRKVkVoZlVFRlVTRjlmRW0xZTRoTXNKVEptYm1WM2N5VXlabk5sRnZrVUVDVXlabVZ0NnZzVUhDVXladklDRUFvTUNZb3dWRVJKUkY5ZkVnRHlBaHdLRVFrVEdGQkJVbFJPUlZJRkdEQUhNMms0YW1JNGF2SUNIUW9WUGg4QVBFbE9WRjlmRWdReU1EWTE4Z0lmQ2hRSklCeEJSRlpGVWxSSlV4RkNHcFlORVBJQ0lnb1lTaUlBQ1VVWUJqTTBPVGN6TXdGbkFCSUpKUnhEUVUxUVFVbEhUZ21IR2o0S0NQSUNJVEZESFNBSlF4d0hNVGs0TXpFek5CM0tHRUZFUjFKUFZWQUpReHBrQ2dGRERjb1pId2xDTEFneE1ERXhORFl4TWZJQ0hoV0hHRkpGUVZSSlZrVUZSQUFJSHUwT0FjMHR5eDBoRFVZd01qRXdPVFEzTlRieUFob0tFQW5OR0VGRVJrOVNUVUVoTHdRR054SzdFd2p5QWlBeE1UeFRWVkJRVEZsV1JVNUVUMUpmWHhJSUhnY0tJUTB0TWpJakFBbG5FQUUzOGdJOEVVTWdTVTFRVWtWVFUwbFBLUzhBSkk2X0R3anlBaFFSbnh4RFFWUkZSMDlTV1VrSkFCZ1JfQlJFUlZaSlEwVU9EZ2dnWDE4U0FsQkQ4Z0laTVRzQVRocWNFQWhRUTE4bEdnQUFIVTRKTnhFWENDQUtHeWtFTG1nSUZGQlNUMFpKVEFGWEdBRXc4Z0lXQ2dzSkl3Qk1KU0lBQnhxVERnanlBaGhScGd4TVQwNUhJUnNlbnc0QmlnQVBDVFFRUTA5VlRsUUZ1eGdHUTJGdVlXUmhJVGNBRXpZY0FCQkZUa05mWHhrZ0NCZ0tEZ2tnRkZKRlIwbFBUZ0ViRkZGMVpXSmxZMEU3VFg4Tkd3MDZFUjhJRVFvTkNUb1FUVVZVVWs4cEx3QVdFWW9VV2tsUVEwOUVBZFVNQTBnelFpSC1EWWNSR1FsTkNSMFYyd0JERG9ZTktGOFNDRTF2Ym5SeVpXRnNBWVJOTmdVYkNUVWRId1FXQ20yb0dGUlNWVk5VUlZNbGFTRkhBQmtSMXd4RVJVRk1CUllBQnhyMER3enlBaHNLVGE4VVRFbE5TVlJmSHZZTkJGOWZCVG9JSWdvZENkY3gxeXhKVGtGUVVGOVBVRlJmVDFWQnRRRmZDQ1FLR1FrbEpGQlNTVlpCVkVWRFQwNEJSd0JVQ1dvc2FtWnplbVF3TV9JQ0tRb2FIU2NFUTFrdFNTMGFPQXQwY21Ga1pXUmxjMnN3TWZJQ0pCR1dhRlZPU1ZoZlZFbE5SVk5VUVUxUVgxOFNDakUyTXpnMk5qZzJOMlgwRFo5SVJFTlBYMDFCVUZCSlRrZFNWVXhGWDAxQlF6R0dGZUZKZmhoUFUwWkJUVWxNUWRJRUFUSkJZaTFUR0V4QlRrZFZRVWNocFFnQ1pXNWh4dzNWSkZKRlRrUkZVa2xPUjE4QjJBUkZXQUgyS0FWUGRHaGxjdklDSXdvZkNkTXNRMVZUVkU5TlFrbEVSRVZTTlVRbEFBUUE4bGtjREVkRlRsSUJZUUFBSVhkTkF4aFFWVUpNU1ZOSXJSUUFCQTZsRFVIRXJUTXNSMFJRVWw5QlVGQk1TVVZUTFpNQUgzRTNCUndNUTA5T1V3NmFDd1JUVkFXanBiQUFHakU5TXBZQUFERnVIUUFBTW00ZEFBQXpBUjN3ZFlBREFJZ0RBWkFEQUpnREY2QURBYW9EQU1BRHJBTElBd0RZQV92dkdPQURBT2dEQVBnREFZQUVBSklFRFM5MWRDOTJNeTl3Y21WaWFXU1lCQUNpQkE0ek55NHhNakF1TWpBMUxqRTRNcWdFQUxJRUR3Z0FFQUVZMkFVZ1dpZ0FNQUE0QXJnRUFNQUVBTWdFQU5vRUFnZ0I0QVFCOEFRU1N4eFVpQVVCbUFVQW9BWEs3ZDd1eWZ2LTUyZkFCUURKQlE2WEhCd0FBUEFfMGdVSkNRa004RWtBQU5nRkFlQUZBZW9GRndvTlpuTmZZV1JmY0hKdlpIVmpkQklHWW1GdWJtVnk4QVdvQV9vRkJBZ0FFQUNRQmdDWUJnQ2lCZzQzTVRJMUkwNVpUVEk2TlRJM09iZ0dBTUVHQUFWUUxQQV8wQWJFMEFIYUJoWUtFQVVSSFFId1VoQUFHQURnQmdIeUJuSUlpcTlORW14QmFFVk1PV3N3UVVGQlFVUkJRV3REUWxGRlNYaEthbTVDZUVSdmFYSlZRMGRLUTJGclFVMW5RbmxuUVZGTk5rcHZVV1JKTlVwRGFFSXhRMGhNVm1sbVMxaEZBVHdKQVJSSVowRm5VVVVKREFFQlpFbG5Ra0ZLUVVKQlNtOUNRV2RuUVlBSEFZZ0hBS0FIQWFvSDBmNEV1Z2NoVEV3QUdBQWdBREFBT0xJRVFBRElCN19OQmRJSERTMGJCRWxBQVI0STJnY0dBZnRNR0FEZ0J3RHFCd0lJQVBBSDJ2OFlpZ2dDRUFBLiZhbXA7cz04ZDYyOTNkMDJhZWJkNGZhODA1N2RiYzFkY2E0Y2I4YWEzZjkwN2NiJmFtcDtiZHJlZj1odHRwcyUzQSUyRiUyRnd3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbSUyRm5ld3MlMkZzZWN1cml0eSUyRmVtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QlMkYmYW1wO2JkdG9wPXRydWUmYW1wO2JkaWZzPTEmYW1wO2JzdGs9aHR0cHMlM0ElMkYlMkZ3d3cuYmxlZXBpbmdjb21wdXRlci5jb20lMkZuZXdzJTJGc2VjdXJpdHklMkZlbW90ZXQtbWFsd2FyZS1pcy1iYWNrLWFuZC1yZWJ1aWxkaW5nLWl0cy1ib3RuZXQtdmlhLXRyaWNrYm90JTJGLGh0dHBzJTNBJTJGJTJGd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJTJGbmV3cyUyRnNlY3VyaXR5JTJGZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdCUyRiZhbXA7XCI%2BPC9zY3JpcHQ%2BPGltZyB3aWR0aD1cIjBcIiBoZWlnaHQ9XCIwXCIgc3R5bGU9XCJkaXNwbGF5OiBibG9jazsgbWFyZ2luOiAwcHg7IHBhZGRpbmc6IDBweDsgd2lkdGg6IDBweDtcIj48ZGl2IG5hbWU9XCJhbnh2XCIgbG50dGFnPVwiO3R2PXZpZXc3LTFocztzdD0wO2Q9MzAweDYwMDt2Yz1pYWI7dmlkX2Njcj0xO3RhZ19pZD0xMzgzMDk1MztjYj1odHRwcyUzQSUyRiUyRm55bTEtaWIuYWRueHMuY29tJTJGdmV2ZW50JTNGYW5fYXVkaXQlM0QwJTI2cmVmZXJyZXIlM0RodHRwcyUyNTNBJTI1MkYlMjUyRnd3dy5ibGVlcGluZ2NvbXB1dGVyLmNvbSUyNTJGbmV3cyUyNTJGc2VjdXJpdHklMjUyRmVtb3RldC1tYWx3YXJlLWlzLWJhY2stYW5kLXJlYnVpbGRpbmctaXRzLWJvdG5ldC12aWEtdHJpY2tib3QlMjUyRiUyNmUlM0R3cVRfM1FLWkJ2Qk1HUU1BQUFNQTFnQUZBUWlGczdDTkJoRFlsWVQ3Nko2eHlsY1lnYjJNMXI2eDFOeDhLallKQkpEYXhNbXRBa0FSYmtiZE9WcVc3VDhaQUFBQUFDbGNIa0FoYmtiZE9WcVc3VDhwQkpBSkpOQXhBQUFBWUlfQzhUOHdxWmJNQmpqVk4wREFDRWhTVUozNmtKb0JXTDY5UTJBQWFNaVVnQUY0djgwRmdBRUJpZ0VEVlZORWtnVUc5TFlCbUFHc0FxQUIyQVNvQVFHd0FRQzRBUUhBQVFYSUFRTFFBUURZQVFEZ0FRRHdBUURZQXA1STRBS2l6MXpxQW0xb2RIUndjem92TDNkM2R5NWliR1ZsY0dsdVoyTnZiWEIxZEdWeUxtTnZiUzl1WlhkekwzTmxZM1Z5YVhSNUwyVnRiM1JsZEMxdFlXeDNZWEpsTFdsekxXSmhZMnN0WVc1a0xYSmxZblZwYkdScGJtY3RhWFJ6TFdKdmRHNWxkQzEyYVdFdGRISnBZMnRpYjNRdmdBTUFpQU1Ca0FNQW1BTVhvQU1CcWdNcUdoTTJNekV3T0RnMU5UUXhNRGs1TkRBNE1EZzRLZ1F5TURZMU9nMXZjblJpTFRnek16UjRZblZod0FPc0FzZ0RBTmdELS04WTRBTUE2QU1BLUFNQmdBUUFrZ1FOTDNWMEwzWXpMM0J5WldKcFpKZ0VBS0lFRGpNM0xqRXlNQzR5TURVdU1UZ3lxQVFBc2dRUU&i=9-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
5U8TrWNxiWyk3BWkvcpXwPzlWtFb2YtsWPoPOhHveww6JXDD13fxYA==
place
freestar-tagan.adlightning.com/ Frame 4248 		0
427 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://freestar-tagan.adlightning.com/place?p=1&d=NBQVFBUmlzQWlENkFTZ0FNQUE0QXJnRUFNQUVBTWdFQU5vRUFnZ0I0QVFCOEFTZC1wQ2FBWWdGQVpnRkFLQUZ5dTNlN3NuN191ZG53QVVBeVFVQUFBQUFBQUR3UDlJRkNRa0FBQUFBQUFBQUFOZ0ZBZUFGQWZBRnFBUDZCUVFJQUJBQWtBWUFtQVlBb2dZT056RXlOU05PV1UweU9qVXlOem00QmdEQkJnQUFBQUFBQVBBXzBBYkUwQUhhQmhZS0VBQUFBQUFBQUFBQUFBQUFBRUVMOEZJUUFCZ0E0QVlCOGdaeUNJcXZUUkpzUVdoRlREbHJNRUZCUVVGRVFVRnJRMEpSUlVsNFNtcHVRbmhFYjJseVZVTkhTa05oYTBGTlowSjVaMEZSVFRaS2IxRmtTVFZLUTJoQ01VTklURlpwWmt0WVJRRThDUUVVU0dkQloxRkZDUXdCQWZBOFNXZENRVXBCUWtGS2IwSkJaMmRCZ0FjQmlBY0FvQWNCcWdjSFlYY3lkMnh6TjdvSER3Z0FFQUFZQUNBQU1BQTRzZ1JBQU1nSHY4MEYwZ2NOQ1FHdURBQUFTVUFCSGdqYUJ3WUpKMFRnQndEcUJ3SUlBUEFIMnY4WWlnZ0NFQUEuJTI2cyUzRDQ2ZDAxZjkxMmE1NWEzZDA2YmUxYzRlMzU1ZTU0YWJmMDJlMWI3ODI7dHM9MTYzODY2ODY3NztjZXQ9MDtjZWNiPVwiIHdpZHRoPVwiMFwiIGhlaWdodD1cIjBcIiBzdHlsZT1cImRpc3BsYXk6IGJsb2NrOyBtYXJnaW46IDA7IHBhZGRpbmc6IDA7IGhlaWdodDogMDsgd2lkdGg6IDA7XCI%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJ0cnVlXCIgc3JjPVwiaHR0cHM6Ly9jZG4uYWRueHMuY29tL3Yvcy8yMjEvdHJrLmpzXCI%2BPC9zY3JpcHQ%2BPC9kaXY%2BPGRpdiBzdHlsZT1cInBvc2l0aW9uOmFic29sdXRlO2xlZnQ6MHB4O3RvcDowcHg7dmlzaWJpbGl0eTpoaWRkZW47XCI%2BPGltZyBzcmM9XCJodHRwczovL255bTEtaWIuYWRueHMuY29tL2l0P2FuX2F1ZGl0PTAmYW1wO3JlZmVycmVyPWh0dHBzJTI1M0ElMjUyRiUyNTJGd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJTI1MkZuZXdzJTI1MkZzZWN1cml0eSUyNTJGZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdCUyNTJGJmFtcDtlPXdxVF8zUUtaQnZCTUdRTUFBQU1BMWdBRkFRaUZzN0NOQmhEWWxZVDc2SjZ4eWxjWWdiMk0xcjZ4MU54OEtqWUpCSkRheE1tdEFrQVJia2JkT1ZxVzdUOFpBQUFBQUNsY0hrQWhia2JkT1ZxVzdUOHBCSkFKSk5BeEFBQUFZSV9DOFQ4d3FaYk1CampWTjBEQUNFaFNVSjM2a0pvQldMNjlRMkFBYU1pVWdBRjR2ODBGZ0FFQmlnRURWVk5Fa2dVRzlMWUJtQUdzQXFBQjJBU29BUUd3QVFDNEFRSEFBUVhJQVFMUUFRRFlBUURnQVFEd0FRRFlBcDVJNEFLaXoxenFBbTFvZEhSd2N6b3ZMM2QzZHk1aWJHVmxjR2x1WjJOdmJYQjFkR1Z5TG1OdmJTOXVaWGR6TDNObFkzVnlhWFI1TDJWdGIzUmxkQzF0WVd4M1lYSmxMV2x6TFdKaFkyc3RZVzVrTFhKbFluVnBiR1JwYm1jdGFYUnpMV0p2ZEc1bGRDMTJhV0V0ZEhKcFkydGliM1F2Z0FNQWlBTUJrQU1BbUFNWG9BTUJxZ01xR2hNMk16RXdPRGcxTlRReE1EazVOREE0TURnNEtnUXlNRFkxT2cxdmNuUmlMVGd6TXpSNFluVmh3QU9zQXNnREFOZ0QtLThZNEFNQTZBTUEtQU1CZ0FRQWtnUU5MM1YwTDNZekwzQnlaV0pwWkpnRUFLSUVEak0zTGpFeU1DNHlNRFV1TVRneXFBUUFzZ1FRQ0FBUUFSaXNBaUQ2QVNnQU1BQTRBcmdFQU1BRUFNZ0VBTm9FQWdnQjRBUUI4QVNkLXBDYUFZZ0ZBWmdGQUtBRnl1M2U3c243X3VkbndBVUF5UVVBQUFBQUFBRHdQOUlGQ1FrQUFBQUFBQUFBQU5nRkFlQUZBZkFGcUFQNkJRUUlBQkFBa0FZQW1BWUFvZ1lPTnpFeU5TTk9XVTB5T2pVeU56bTRCZ0RCQmdBQUFBQUFBUEFfMEFiRTBBSGFCaFlLRUFBQUFBQUFBQUFBQUFBQUFFRUw4RklRQUJnQTRBWUI4Z1p5Q0lxdlRSSnNRV2hGVERsck1FRkJRVUZFUVVGclEwSlJSVWw0U21wdVFuaEViMmx5VlVOSFNrTmhhMEZOWjBKNVowRlJUVFpLYjFGa1NUVktRMmhDTVVOSVRGWnBaa3RZUlFFOENRRVVTR2RCWjFGRkNRd0JBZkE4U1dkQ1FVcEJRa0ZLYjBKQloyZEJnQWNCaUFjQW9BY0JxZ2NIWVhjeWQyeHpON29IRHdnQUVBQVlBQ0FBTUFBNHNnUkFBTWdIdjgwRjBnY05DUUd1REFBQVNVQUJIZ2phQndZSkowVGdCd0RxQndJSUFQQUgydjhZaWdnQ0VBQS4mYW1wO3M9NDZkMDFmOTEyYTU1YTNkMDZiZTFjNGUzNTVlNTRhYmYwMmUxYjc4MlwiPjwvZGl2PjwvZGl2PjxpZnJhbWUgc3JjPVwiYWJvdXQ6YmxhbmtcIiBjbGFzcz1cIl9udG5yamY3ODI2LWhqXCIgc3R5bGU9XCJ3aWR0aDogMHB4ICFpbXBvcnRhbnQ7IGhlaWdodDogMHB4ICFpbXBvcnRhbnQ7IGJvcmRlcjogMHB4ICFpbXBvcnRhbnQ7IHBvc2l0aW9uOiBhYnNvbHV0ZSAhaW1wb3J0YW50OyB0b3A6IC0xMDAwMHB4ICFpbXBvcnRhbnQ7IGxlZnQ6IC0xMDAwMHB4ICFpbXBvcnRhbnQ7XCI%2BPC9pZnJhbWU%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3d3dy5nb29nbGV0YWdzZXJ2aWNlcy5jb20vYWN0aXZldmlldy9qcy9jdXJyZW50L3J4X2xpZGFyLmpzP2NhY2hlPXIyMDExMDkxNFwiPjwvc2NyaXB0PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPm9zZGxmbSgpOzwvc2NyaXB0PjxkaXYgc3R5bGU9XCJib3R0b206MDtyaWdodDowO3dpZHRoOjEwMHB4O2hlaWdodDoxMDBweDtiYWNrZ3JvdW5kOmluaXRpYWwgIWltcG9ydGFudDtwb3NpdGlvbjphYnNvbHV0ZSAhaW1wb3J0YW50O21heC13aWR0aDoxMDAlICFpbXBvcnRhbnQ7bWF4LWhlaWdodDoxMDAlICFpbXBvcnRhbnQ7cG9pbnRlci1ldmVudHM6bm9uZSAhaW1wb3J0YW50O2ltYWdlLXJlbmRlcmluZzpwaXhlbGF0ZWQgIWltcG9ydGFudDt6LWluZGV4OjIxNDc0ODM2NDc7YmFja2dyb3VuZC1pbWFnZTp1cmwoJ2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQ3NBQUFBV0JBTUFBQUNybDNpQUFBQUFCbEJNVkVVQUFBRCtBY2lXbVp6V0FBQUFBblJTVGxNQUFwaWRyQlFBQUFCNVNVUkJWQmpUYlpFQkRzQWdDQVByRC9yLzF5N1lDbldSbUUyeUEwOEd2R01wdEprTTNGOEprcEZ0QWtYWDZzeGNQZUUza3hZYjlMTzN6MjdXSmhNMDI5NHdjb3FLNmJZVXJ5VUwxeUJ3SUZodHp5enlyTnZEdC94NXIvR08xaXFRazFUTndWMVhUSVBnTlp5bWdVdHBvRjF3N3BnbS9xbkFCMHRYQlpHM0I4QThBQUFBQUVsRlRrU3VRbUNDJykgIWltcG9ydGFudDtcIj48L2Rpdj48aWZyYW1lIHNyYz1cIi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9zb2Rhci9FbnF6XzIwVS5odG1sXCIgd2lkdGg9XCIwXCIgaGVpZ2h0PVwiMFwiIHN0eWxlPVwiZGlzcGxheTogbm9uZTtcIj48L2lmcmFtZT48L2JvZHk%2BPC9odG1sPjwhLS0gSUZSQU1FIElOTkVSIENPTlRFTlQgLS0%2BPGlmcmFtZSBzcmM9XCJhYm91dDpibGFua1wiIGNsYXNzPVwiX250bnJqZjc4MjYtaGpcIiBzdHlsZT1cIndpZHRoOiAwcHggIWltcG9ydGFudDsgaGVpZ2h0OiAwcHggIWltcG9ydGFudDsgYm9yZGVyOiAwcHggIWltcG9ydGFudDsgcG9zaXRpb246IGFic29sdXRlICFpbXBvcnRhbnQ7IHRvcDogLTEwMDAwcHggIWltcG9ydGFudDsgbGVmdDogLTEwMDAwcHggIWltcG9ydGFudDtcIj48aGVhZD48c2NyaXB0IHNyYz1cImh0dHBzOi8vc3RhdGljLmFkc2FmZXByb3RlY3RlZC5jb20vc2NhLjE3LjUuMTIuanNcIj48L3NjcmlwdD48L2hlYWQ%2BPGJvZHkgb25sb2FkPVwidmFyIGQgPSBkb2N1bWVudDt2YXIgcyA9IGQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7ZC5nZXRFbGVtZW50c0J5VGFnTmFtZSgnaGVhZCcpWzBdLmFwcGVuZENoaWxkKHMpLnNyYz0naHR0cHM6Ly9zdGF0aWMuYWRzYWZlcHJvdGVjdGVkLmNvbS9zY2EuMTcuNS4xMi5qcydcIj48L2JvZHk%2BPC9pZnJhbWU%2BIiwibWV0YSI6eyJwbFJhdGlvIjowLjAxfX0%3D&i=10-10&t=adltag_kwsl0tj7_JP3pNbyg9W&r=80ee0df435513f09f907cc9e5b2d694&c=freestar&z=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-103.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:19:33 GMT
via
1.1 96d147941ae6bca8fe66457104d07bb6.cloudfront.net (CloudFront)
age
1512
x-cache
Error from cloudfront
content-length
0
last-modified
Mon, 15 Jun 2020 20:53:30 GMT
server
AmazonS3
etag
"d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
YY3N9.DaL5lhf0ZKqlAxExqrtZeVzglu
access-control-allow-origin
*
x-amz-cf-pop
EWR53-C2
accept-ranges
bytes
content-type
text/plain
x-amz-cf-id
CkjzilnOIShJ21ZgbTqyHR0nMXgfmPZSeZvGVLpPRb8bbH1h0rJdRQ==
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=10&f=0&j=&t=1638668682534&de=747971473107&cu=1638668682534&m=1190&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=804&lg=1&lh=226&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A512%3A512%3A0%3A602&as=1&ag=1176&an=4&gi=1&gf=1176&gg=4&ix=1176&ic=1176&ez=1&ck=1176&kw=865&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1176&bx=4&ci=1176&jz=865&dj=1&aa=0&ad=934&cn=0&gk=934&gl=0&ik=934&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=865&cd=8&ah=865&am=8&xd=00&rf=0&re=1&ft=934&fv=0&fw=934&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&ti=0&ih=1&jk=-1&jm=2&tc=0&fs=195402&na=1720379426&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
pagead2.googlesyndication.com/bg/ Frame B117 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e127dce391c5b30b9f8027fc7d0097db662ce9c6af8eef63207ffe4a1432b55d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
383038
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13379
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 30 Nov 2022 15:20:46 GMT
rtb-h
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 9B06
Redirect Chain
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=c37cf53a-b31d-44ca-8259-d06cf5f5798d-tuct8a59f0c&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...
0
149 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=c37cf53a-b31d-44ca-8259-d06cf5f5798d-tuct8a59f0c&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 varnish
x-served-by
cache-yul12829-YUL
x-cache
MISS
x-cache-hits
0
x-timer
S1638668684.491223,VS0,VE12
content-length
0

Redirect headers

server
nginx
location
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=c37cf53a-b31d-44ca-8259-d06cf5f5798d-tuct8a59f0c&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 varnish
x-served-by
cache-yul12820-YUL
x-cache
MISS
x-cache-hits
0
x-timer
S1638668684.405605,VS0,VE10
x-vcl-time-ms
10
content-length
0
Pug
image2.pubmatic.com/AdServer/ Frame 4C10
Redirect Chain
  • https://gocm.c.appier.net/pubmatic
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sSE8PgZVA8-yk7I4jRmsYQ
42 B
399 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sSE8PgZVA8-yk7I4jRmsYQ
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 00:20:04 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug026:0:465
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:44:45 GMT
content-type
text/html; charset=utf-8
content-length
153
cache-control
no-store
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=sSE8PgZVA8-yk7I4jRmsYQ
p3p
CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pug
simage2.pubmatic.com/AdServer/ Frame EC71
Redirect Chain
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
0
89 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 00:18:21 GMT
content-type
text/html; charset=utf-8
x-lat
njrpug023:2:294
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private
content-encoding
gzip

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
content-length
0
date
Sun, 05 Dec 2021 01:44:44 GMT
server
_
pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame 2389
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=a5677e3a-ded4-44c9-b5be-254f6a67d483&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F458BC18-DC0D-48F9-98CC-615D57A2C396
42 B
353 B 		Document
General
Check archive.org
Download Go to
Full URL
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.229.208 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-229-208.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-type
image/gif
content-length
42
server
Kestrel

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:44:44 GMT
x-lat
njrpug018:0:616
location
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=F458BC18-DC0D-48F9-98CC-615D57A2C396
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private
cookiesync
core.iprom.net/ Frame D9B8 		43 B
281 B 		Document
General
Check archive.org
Download Go to
Full URL
https://core.iprom.net/cookiesync
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

Vary
Accept-Encoding
X-adserver-worker
ragnarok-63b399b43b83@version_1.362v2
Connection
close
X-server-arch
v2
Content-Type
image/gif
Content-Length
43
X-core-time
0ms
Date
Sun, 05 Dec 2021 01:44:44 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 21DD
Redirect Chain
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
1 B
145 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:44:44 GMT
content-type
text/html; charset=utf-8
content-length
1
x-lat
njrpug014:0:517
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:44:44 GMT
content-type
text/html
content-length
138
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:DBE6805D465846A3966128D6AD5D95CA
expires
Sat, 04 Dec 2021 01:44:44 GMT
cache-control
no-cache
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
access-control-allow-origin
*
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
mw
mwzeom.zeotap.com/ Frame 69CD
Redirect Chain
  • https://pixel.onaudience.com/?partner=214&mapped=F458BC18-DC0D-48F9-98CC-615D57A2C396
  • https://spl.zeotap.com/?zdid=1332&zcluid=27ef478db6b78c1a
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=520b764d-9055-4078-6f4a-c901c72165e5&reqId=822c8510-c947-4cac-5c97-fb0cc182e2fc&zclui...
  • https://mwzeom.zeotap.com/mw?google_gid=CAESEESUQTi3LVAY1_mv94JUZfM&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=520b764d-9055-4078-6f4a-c901c72165e5&reqId=822c8510-c947-4cac-5c97-fb0...
95 B
187 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mwzeom.zeotap.com/mw?google_gid=CAESEESUQTi3LVAY1_mv94JUZfM&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=520b764d-9055-4078-6f4a-c901c72165e5&reqId=822c8510-c947-4cac-5c97-fb0cc182e2fc&zcluid=27ef478db6b78c1a&zdid=1332
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
6b899751d84cca67-YUL
access-control-allow-headers
*
content-length
95

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://mwzeom.zeotap.com/mw?google_gid=CAESEESUQTi3LVAY1_mv94JUZfM&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=520b764d-9055-4078-6f4a-c901c72165e5&reqId=822c8510-c947-4cac-5c97-fb0cc182e2fc&zcluid=27ef478db6b78c1a&zdid=1332
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
469
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
p.gif
visitor.fiftyt.com/ Frame 69CD
Redirect Chain
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=&fbounce=1
0
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=&fbounce=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
35.201.96.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
126.96.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
clear
content-length
0
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=F458BC18-DC0D-48F9-98CC-615D57A2C396&gdpr=&fbounce=1
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
144
g.pixel
aa.agkn.com/adscores/ Frame 69CD 		43 B
682 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=F458BC18-DC0D-48F9-98CC-615D57A2C396
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
156.154.202.36 , United States, ASN19907 (NEUSTAR-AS6, US),
Reverse DNS
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
AAWebServer
Access-Control-Allow-Methods
GET, POST, OPTIONS
P3P
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Type
image/gif
Access-Control-Allow-Headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
Content-Length
43
Expires
0
/
io.narrative.io/ Frame 69CD
Redirect Chain
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:F458BC18-DC0D-48F9-98CC-615D57A2C396
  • https://io.narrative.io/?io.narrative.guid.v2=ebedc561-556c-11ec-8734-065a0b8073db&companyId=673&id=pubmatic_id:F458BC18-DC0D-48F9-98CC-615D57A2C396
0
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.narrative.io/?io.narrative.guid.v2=ebedc561-556c-11ec-8734-065a0b8073db&companyId=673&id=pubmatic_id:F458BC18-DC0D-48F9-98CC-615D57A2C396
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Server
54.83.242.41 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-83-242-41.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
no-cache
Server
nginx/1.18.0
Connection
keep-alive

Redirect headers

Location
https://io.narrative.io/?io.narrative.guid.v2=ebedc561-556c-11ec-8734-065a0b8073db&companyId=673&id=pubmatic_id:F458BC18-DC0D-48F9-98CC-615D57A2C396
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
nginx/1.18.0
Connection
keep-alive
Content-Length
0
Pug
simage2.pubmatic.com/AdServer/ Frame 69CD
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4764934967218434204
42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4764934967218434204
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:00:21 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug021:0:458
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4764934967218434204
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame 69CD
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8987304192775495297
42 B
129 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8987304192775495297
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug015:0:375
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
93af5d62-9cc3-4877-b187-8a91fefcbf2b
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8987304192775495297
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 69CD
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:1dac68b7-b69a-4192-845a-8b17d560cf53&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:1dac68b7-b69a-4192-845a-8b17d560cf53&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug025:0:365
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:1dac68b7-b69a-4192-845a-8b17d560cf53&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
d1ba4609
rtb.gumgum.com/getuid/ Frame 69CD 		35 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.202.147.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-202-147-57.compute-1.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0
crum
dsum-sec.casalemedia.com/ Frame 8EDC
Redirect Chain
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
03d17a99-482e-4ede-bf56-0a4770f16c29
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 8EDC
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
MT3 4133 baa842e master iad-pixel-x19 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:43 GMT
rum
dsum-sec.casalemedia.com/ Frame 8EDC
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638668684.486687,VS0,VE0
x-served-by
cache-yul12823-YUL
x-cache
HIT
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 8EDC
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&gdpr_consent=&us_privacy=&gdpr=
  • https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
43 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
date
Sun, 05 Dec 2021 01:44:44 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
dcm
s.amazon-adsystem.com/ Frame 8EDC 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
GFWKCHRNDT7TQK070MNB
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 8EDC
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=29
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=4764934967218434204&expiration=1639878284
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=4764934967218434204&expiration=1639878284
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
nginx
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=4764934967218434204&expiration=1639878284
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 8EDC 		43 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB?gdpr_consent=&us_privacy=&gdpr=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
htw-pixel.gif
js-sec.indexww.com/ht/ Frame 8EDC 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?YawZhBbaf-sLobsSgmffIQAA%26075
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2457
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 02:25:41 GMT
4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
pagead2.googlesyndication.com/bg/ Frame 014D 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e127dce391c5b30b9f8027fc7d0097db662ce9c6af8eef63207ffe4a1432b55d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
383038
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13379
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 30 Nov 2022 15:20:46 GMT
nxh61y00tA73Nuy4zCQ9
dmx.districtm.io/s/10027/ Frame D53A
Redirect Chain
  • https://us.creativecdn.com/cm-notify?pi=districtm
  • https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
76 B
168 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08f07fe6ccc95f5355c2d99f8ffa854aa6911710125cdc26d3cbd8b48568ede5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89974eaf8aecfa-YUL

Redirect headers

location
https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT, Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
fjjYmhumTpxKx2Vf1I9_oCV4zbY
dmx.districtm.io/s/10026/ Frame D53A
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=132
  • https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
83 B
172 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f45a889bad84e2aeab39ded79da5aa568bca08dcf1bf573d2b11262b9cf9289
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89974f483decfa-YUL

Redirect headers

Location
https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
Date
Sun, 05 Dec 2021 01:44:44 GMT
Connection
keep-alive
Content-Length
83
Content-Type
text/html; charset=utf-8
979321821552651232
dmx.districtm.io/s/10056/ Frame D53A
Redirect Chain
  • https://p.rfihub.com/cm?pub=36496&in=1
  • https://dmx.districtm.io/s/10056/979321821552651232
74 B
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10056/979321821552651232
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f9c6e99f4a6f8609f7ea272ad3b19aabd6cdc50779cea5806a04ae7fa22eb11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89974f4840ecfa-YUL

Redirect headers

Location
https://dmx.districtm.io/s/10056/979321821552651232
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
sync
x.bidswitch.net/ Frame D53A
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=districtm&user_id=21qVcYtoROmI7iVfVngDipq6SdP
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=e844459d-39b0-402c-bf5a-7640e7a8c718&ssp=districtm&gdpr=&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10597814350218064749&gdpr=&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vis...
  • https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=a507803e-3812-41e4-80b2-78e5739cd1db&ssp=districtm&gdpr_consent=&gdpr=
  • https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=[mPlatform_cookie_ID]&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
  • https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=205010403991001836584&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10597814350218064749&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
43 B
220 B 		Script
General
Check archive.org
Download Go to
Full URL
https://x.bidswitch.net/sync?dsp_id=419&user_id=10597814350218064749&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
18.195.106.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-106-43.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e2d868f56353cfa8f98f458b5bb7edf7585e67750a7dc681947d86c10f680499

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:45 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 google
server
Apache
p3p
CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location
https://x.bidswitch.net/sync?dsp_id=419&user_id=10597814350218064749&ssp=<SSP_VALUE>&gdpr=&gdpr_consent=
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
x-application-context
application
expires
Thu, 01 Jan 1970 00:00:00 GMT
y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
dmx.districtm.io/s/10051/ Frame D53A
Redirect Chain
  • https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
  • https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
131 B
184 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05e21e597d8b39daf0423ada3660186627b4414356218094a904ded553cec780
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89975059e1ecfa-YUL

Redirect headers

location
https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
date
Sun, 05 Dec 2021 01:44:44 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
crum
dsum-sec.casalemedia.com/ Frame ECA1
Redirect Chain
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
686626a4-9fee-4699-b5a0-161ec717ba8c
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8987304192775495297
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame ECA1
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
MT3 4133 baa842e master iad-pixel-x15 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=badc61ac-1985-4000-9788-0d2b1d82255b
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:44:43 GMT
YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame ECA1
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&gdpr_consent=&us_privacy=&gdpr=
  • https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
43 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
date
Sun, 05 Dec 2021 01:44:44 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
rum
dsum-sec.casalemedia.com/ Frame ECA1
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638668685.535830,VS0,VE0
x-served-by
cache-yul12823-YUL
x-cache
HIT
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YawZhQAJhLX5VAAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
YawZhBbaf_sLobsSgmffIQAAAEsAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame ECA1 		43 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YawZhBbaf_sLobsSgmffIQAAAEsAAAIB?gdpr_consent=&us_privacy=&gdpr=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
us.php
gu.dyntrk.com/adx/ie/ Frame ECA1 		0
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
51.81.106.33 New York, United States, ASN16276 (OVH, FR),
Reverse DNS
ns106714.ip-51-81-106.us
Software
proxy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
cache-control
private, no-cache, no-store, proxy-revalidate, no-transform
x-rc
10
server
proxy
content-length
0
content-type
text/plain
crum
dsum-sec.casalemedia.com/ Frame ECA1
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301220038102
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301220038102
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
cf-cache-status
DYNAMIC
x-function
209
server
cloudflare
x-reuse-index
164
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6b89974e5dea7151-YUL
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301220038102
cache-control
no-cache, private
content-type
text/html
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame ECA1
Redirect Chain
  • https://sync.extend.tv/r.gif?exchange=index
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=d513aecf-8a99-446b-bf4a-ab692c053dae
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=d513aecf-8a99-446b-bf4a-ab692c053dae
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Access-Control-Allow-Origin
*
Content-Type
text/html; charset=utf-8
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=d513aecf-8a99-446b-bf4a-ab692c053dae
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
132
Expires
Tue, 29 May 1984 15:00:00 GMT
htw-pixel.gif
js-sec.indexww.com/ht/ Frame ECA1 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?YawZhBbaf-sLobsSgmffIQAA%26075
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2457
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 02:25:41 GMT
nxh61y00tA73Nuy4zCQ9
dmx.districtm.io/s/10027/ Frame 381B
Redirect Chain
  • https://us.creativecdn.com/cm-notify?pi=districtm
  • https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
76 B
132 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08f07fe6ccc95f5355c2d99f8ffa854aa6911710125cdc26d3cbd8b48568ede5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89974eaf8becfa-YUL

Redirect headers

location
https://dmx.districtm.io/s/10027/nxh61y00tA73Nuy4zCQ9?pi=districtm
pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT, Sun, 05 Dec 2021 01:44:44 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
fjjYmhumTpxKx2Vf1I9_oCV4zbY
dmx.districtm.io/s/10026/ Frame 381B
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=132
  • https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
83 B
147 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f45a889bad84e2aeab39ded79da5aa568bca08dcf1bf573d2b11262b9cf9289
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89974f7893ecfa-YUL

Redirect headers

Location
https://dmx.districtm.io/s/10026/fjjYmhumTpxKx2Vf1I9_oCV4zbY
Date
Sun, 05 Dec 2021 01:44:44 GMT
Connection
keep-alive
Content-Length
83
Content-Type
text/html; charset=utf-8
979321821552651232
dmx.districtm.io/s/10056/ Frame 381B
Redirect Chain
  • https://p.rfihub.com/cm?pub=36496&in=1
  • https://dmx.districtm.io/s/10056/979321821552651232
74 B
137 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10056/979321821552651232
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f9c6e99f4a6f8609f7ea272ad3b19aabd6cdc50779cea5806a04ae7fa22eb11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89974f7896ecfa-YUL

Redirect headers

Location
https://dmx.districtm.io/s/10056/979321821552651232
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
dmx.districtm.io/s/10051/ Frame 381B
Redirect Chain
  • https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
  • https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
131 B
264 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05e21e597d8b39daf0423ada3660186627b4414356218094a904ded553cec780
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b89975069f1ecfa-YUL

Redirect headers

location
https://dmx.districtm.io/s/10051/y-HIpdFGFE2uET6Qp98yzlhicAmkwY.R6.~A~VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
date
Sun, 05 Dec 2021 01:44:44 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
e844459d-39b0-402c-bf5a-7640e7a8c718
dmx.districtm.io/s/10009/ Frame 381B
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=districtm&user_id=21qVcdesu5KLspVqdWBe9wYqfv7
  • https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=districtm&gdpr=&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=districtm&gdpr=0&user_id=qeRHCK7sHl6y4h4K_uMLWqmzE1my5hEP_eWvh-W-
  • https://dmx.districtm.io/s/10009/e844459d-39b0-402c-bf5a-7640e7a8c718
92 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10009/e844459d-39b0-402c-bf5a-7640e7a8c718
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1f8a83d3cc9d3c704e8520938e8bf6720434616fefd0f04dc98e2139d30bf5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:44:45 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899751bb0fecfa-YUL

Redirect headers

Location
//dmx.districtm.io/s/10009/e844459d-39b0-402c-bf5a-7640e7a8c718
Date
Sun, 05 Dec 2021 01:44:44 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
pagead2.googlesyndication.com/bg/ Frame 4B3D 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/4Sfc45HFswufgCf8fQCX22Ys6cavju9jIH_-ShQytV0.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e127dce391c5b30b9f8027fc7d0097db662ce9c6af8eef63207ffe4a1432b55d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:20:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
383038
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13379
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 30 Nov 2022 15:20:46 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9a0fbde3-9ae8-f13c-53d9-a0aff1deee14&tv=%7Bc:vSM1eD,time:2799,type:e,im:%7Bpci:%7Btdr:1709%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:2799,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:1082.2329.300.600,am:i,cc:1082.2329.300.600,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B2793~0%5D,as:%5B2793~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:290,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n.877959-58497149%7C1n1%7C1o.877959-58497149%7C1o1%7C1p.877959-58497151%7C1p1%7C1q*.877959-58497147%7C1r.877959-58497149%7C1s,idMap:1q*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
x-server-name
dt17.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
log
c21lg-d.media.net/ Frame F7F3 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-con&ovsid=0f7f9703-e059-4dff-b912-4c9c58be3492&cs=15&vsid=2816702837397404000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
Jetty(9.4.35.v20201120)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Sun, 05 Dec 2021 01:44:44 GMT
log
c21lg-d.media.net/ Frame 75A8 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-con&ovsid=0f7f9703-e059-4dff-b912-4c9c58be3492&cs=15&vsid=2816702837397404000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
server
Jetty(9.4.35.v20201120)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Sun, 05 Dec 2021 01:44:44 GMT
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
cs&eq_cc=1
um2.eqads.com/um/ Frame 3FF7
Redirect Chain
  • https://um2.eqads.com/um/cs
  • https://um2.eqads.com/um/cs&eq_cc=1
186 B
370 B 		Document
General
Check archive.org
Download Go to
Full URL
https://um2.eqads.com/um/cs&eq_cc=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.142.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-142-27.compute-1.amazonaws.com
Software
/
Resource Hash
229fbe11830e86deb5bb19aa918b137968fa86f060f78d88cd67c501a4552b3d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-type
text/html; charset=utf-8
content-length
186
cache-control
no-cache, must-revalidate
expires
Sat, 6 May 1995 12:00:00 GMT
last-modified
Sun, 05 Dec 2021 01:44:44 GMT
pragma
no-cache

Redirect headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-type
text/html; charset=utf-8
content-length
41
location
/um/cs&eq_cc=1
0.js
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/ Frame 8210 		319 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Requested by
Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=6afacd1e-1950-4d89-a104-277b55ddc0b4&pblob=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1001 Ashburn, United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

ats-carp-promotion
1
date
Mon, 29 Nov 2021 16:25:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465532
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-length
104909
x-amz-id-2
ViDU7qxIVXCQ1OoL+wnEuf7bcOjIs2T7ni4ZpbYjPgnIAOe5CwvGhyqrgU0nSXPjJWD8zviCczc=
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 29 Oct 2021 12:07:18 GMT
server
ATS
etag
"ad866575d644f8b5c5d7a56ff730d7e3-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-request-id
XVSF9HDPN0WNYG5D
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=1209600
x-amz-version-id
null
accept-ranges
bytes
content-type
application/javascript
impression.gif
trk.vidible.tv/trk/ Frame 8210 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.82&ifr=true&cb=0.383891563130911&pt=o2unit&sid=d3804f9b-131b-466c-ba0c-f99c569337df&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
async_usersync
ib.adnxs.com/ Frame F92B 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
14511193-b8dd-44af-a7f3-2dc2513206cc
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 5C5E 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
924e8680-3a4a-474d-887d-650b5259ffc5
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame B142 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
ea69b75b81243d7429f2762349a7b95e0fc43ca337db14df218371e656286357

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:44:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17694
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:38 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=10&f=0&j=&t=1638668682534&de=747971473107&cu=1638668682534&m=1191&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=804&lg=1&lh=226&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A512%3A512%3A0%3A602&as=1&ag=1176&an=1176&gi=1&gf=1176&gg=1176&ix=1176&ic=1176&ez=1&ck=1176&kw=865&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1176&bx=1176&ci=1176&jz=865&dj=1&aa=0&ad=934&cn=934&gk=934&gl=934&ik=934&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=865&cd=865&ah=865&am=865&xd=00&rf=0&re=1&ft=934&fv=934&fw=934&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&ti=0&ih=1&jk=-1&jm=2&tc=0&fs=195402&na=2107987822&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
async_usersync
ib.adnxs.com/ Frame 034B 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
087e8b4d-76e1-4e37-8761-db741c1ef1f7
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 09E2 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
b0452498-255b-496d-bfc2-788744197e8d
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame F0A3 		0
836 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&e=wqT_3QKXBvBMFwMAAAMA1gAFAQiFs7CNBhD0vbDIk_yfu2MYgb2M1r6x1Nx8KjYJBJDaxMmtAkARbkbdOVqW7T8ZAAAAAClcHkAhbkbdOVqW7T8pBJAJJNAxAAAAYI_C8T8wqZbMBjjVN0DACEhSUJb6kJoBWL69Q2AAaMiUgAF4v80FgAEBigEDVVNEkgUG9KgBmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCnkjgAp3_W-oCbWh0dHBzOi8vd3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tL25ld3Mvc2VjdXJpdHkvZW1vdGV0LW1hbHdhcmUtaXMtYmFjay1hbmQtcmVidWlsZGluZy1pdHMtYm90bmV0LXZpYS10cmlja2JvdC-AAwCIAwGQAwCYAxegAwGqAyoaEzcxNjcwNTY0NjIzMDgxODc4OTIqBDIwNjU6DW9ydGItbHcycTJ0N3nAA6wCyAMA2AP77xjgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMzcuMTIwLjIwNS4xODKoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAElvqQmgGIBQGYBQCgBcrt3u7J-_7nZ8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBagD-gUECAAQAJAGAJgGAKIGDjcxMjUjTllNMjo1Mjc5uAYAwQYAAAAAAADwP9AGxNAB2gYWChAh_S4BAPBSEAAYAOAGAfIGcgiKr00SbEFoRUw5azBBQUFBREFBa0NCUUVJeEpqbkJ4RG9pclVDR0pDYWtBTWdCeWdBUU02Sm9RZEk1SkNoQjFDSExWaWZLWEUBPAkBFEhnQWdRRQkMAQHwPElnQkFKQUJBSm9CQWdnQYAHAYgHAKAHAaoHB2F3Mndscze6Bw8IABAAGAAgADAAOLIEQADIB7_NBdIHDQkJtgRJQAEeCNoHBgknROAHAOoHAggA8Afa_xiKCAIQAA..&s=a4273c59291343a224a78bc3e47451c3186f144a&type=pv&jm=1003&px=436&py=226&bw=728&bh=90&sf=1&sid=6752841121935943592&vd=ct~0|rr~5&sv=221&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=13830953&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.206 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
798.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 798.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
04b7fa30-4042-4bed-b5b3-78b86cba9206
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 2D75 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7125&pub_id=863137&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7125&pub_id=863137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
dc619235-71a8-4caa-9aa8-005204c44713
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=10&f=0&j=&t=1638668682534&de=747971473107&cu=1638668682534&m=1191&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=804&lg=1&lh=226&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A512%3A512%3A0%3A602&as=1&ag=1176&an=1176&gi=1&gf=1176&gg=1176&ix=1176&ic=1176&ez=1&ck=1176&kw=865&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1176&bx=1176&ci=1176&jz=865&dj=1&aa=0&ad=934&cn=934&gk=934&gl=934&ik=934&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=865&cd=865&ah=865&am=865&xd=00&rf=0&re=1&ft=934&fv=934&fw=934&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&ti=0&ih=1&jk=-1&jm=2&tc=0&fs=195402&na=1152172403&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
moatapi.js
z.moatads.com/aolvidibleapi29384728347/ Frame 3FC7 		133 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-encoding
gzip
last-modified
Tue, 25 Feb 2020 18:37:38 GMT
server
AmazonS3
x-amz-request-id
173F0BEA92CD9AC6
etag
"d678022569896f7b7293494e3a69c8c7"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11209
accept-ranges
bytes
content-length
44266
x-amz-id-2
RklxkPdiYk8GhMpdx5iMxA7DvkiGo6tkMATS2fpRD27gNLLlz56AlUBtVoddESPwbLn/omOVHYo=
sp.js
tag.sp.advertising.com/ Frame 8210 		1 KB
919 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.sp.advertising.com/sp.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.32.163 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81BA) /
Resource Hash
3d48b44f1a81248c7fa11ec634852c317f855f3505442e41d8bfced0f0db0e94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
content-encoding
gzip
etag
"4bea0b4a9a14ce1a32b257d422a82530+gzip"
last-modified
Wed, 18 Aug 2021 13:17:52 GMT
server
ECS (cha/81BA)
age
102
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
x-amz-request-id
N7YFFAANRWB36EKM
content-length
616
x-amz-id-2
LBe1ruESpXqJTi9b6kVACj8twAmg6ybeqjILW0j5QrwvaDITuQ23Bq9ck5dOKR2aYQ952ZIHbZU=
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads-ec.v.ssp.yahoo.com/a/h/ Frame 8210
Redirect Chain
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668682700&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&p...
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668682700&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.he...
249 B
0 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668682700&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=e11dd817-d7d5-4019-812c-bacbd3e1e5fa&a.is_yahoo=3&redirect_y=dHM9MTYzODY2ODY4NDg0Ni4yNjQ0MDQ6dXVpZD0iODY4MzA4NTQ5NDI2OTIyODg4NF9fVElNRV9fMjAyMS0xMi0wNCsxNyUzQTQ0JTNBMzgiOmFwaWQ9VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ6cmVxdWVzdF9pZD1lMTFkZDgxNy1kN2Q1LTQwMTktODEyYy1iYWNiZDNlMWU1ZmE=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
52.1.108.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-108-21.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:45 GMT
content-encoding
gzip
server
ATS/9.1.0.33
Age
0
content-type
text/xml
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
192
expires
0

Redirect headers

strict-transport-security
max-age=31536000
server
adaptv/1.0
access-control-allow-origin
https://www.bleepingcomputer.com
content-type
text/plain
location
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668682700&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=e11dd817-d7d5-4019-812c-bacbd3e1e5fa&a.is_yahoo=3&redirect_y=dHM9MTYzODY2ODY4NDg0Ni4yNjQ0MDQ6dXVpZD0iODY4MzA4NTQ5NDI2OTIyODg4NF9fVElNRV9fMjAyMS0xMi0wNCsxNyUzQTQ0JTNBMzgiOmFwaWQ9VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ6cmVxdWVzdF9pZD1lMTFkZDgxNy1kN2Q1LTQwMTktODEyYy1iYWNiZDNlMWU1ZmE=
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
0
display.gif
trk.vidible.tv/trk/ Frame 8210 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d3804f9b-131b-466c-ba0c-f99c569337df&vvuid=e7b89782-0709-4327-934b-9b3355ef38fa&orgId=28949&plcid=1279691&vrid=6afacd1e-1950-4d89-a104-277b55ddc0b4&ab=0&dt=346&h=469&spaceid=793604934&w=834&cb=0.5815575977039071
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
ad-request.gif
trk.vidible.tv/trk/ Frame 8210 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d3804f9b-131b-466c-ba0c-f99c569337df&vvuid=e7b89782-0709-4327-934b-9b3355ef38fa&orgId=28949&plcid=1279691&vrid=6afacd1e-1950-4d89-a104-277b55ddc0b4&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.21698135230012938
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
ad-engine-request.gif
trk.vidible.tv/trk/ Frame 8210 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d3804f9b-131b-466c-ba0c-f99c569337df&vvuid=e7b89782-0709-4327-934b-9b3355ef38fa&orgId=28949&plcid=1279691&vrid=6afacd1e-1950-4d89-a104-277b55ddc0b4&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=469&cb=0.6210854340238801
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:44 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:44 GMT
match
cms-xch-chicago.33across.com/ Frame B142
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=
  • https://ssc-cms.33across.com/ps/?xi=1&xu=KWSL0RE8-3-ILJG
  • https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL0RE8-3-ILJG&ts=1638668685&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL0RE8-3-ILJG&ts=1638668685&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:44 GMT
referrer-policy
unsafe-url
server
33XP003
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL0RE8-3-ILJG&ts=1638668685&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
crum
dsum-sec.casalemedia.com/ Frame 3FF7 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=6fb51e2f-a118-4c64-a2e3-9b08e033535b&expiration=1646444684
Requested by
Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://um2.eqads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:44 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:44:44 GMT
ca
choices.trustarc.com/ Frame 5491 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=tradedesk01cont1&js=pmw1&base=te-clr1-bdcabb12-f445-44bd-955d-a8f70b4110b7&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
8e2f82ba358ede9370ae2bfe07ad79e6c9aa533ba777cb617199ece8e4b4f2aa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 21:42:47 GMT
content-encoding
gzip
server
nginx
age
14518
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
content-length
2413
x-amz-cf-id
eHyNOAkTEzYxdUdx3VEVbTlvENzkSFVN18kgNCWQdiZ7dC1mwZ-ilw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 5491 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=tradedesk01cont1&js=pmw2
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 17:38:19 GMT
content-encoding
gzip
server
nginx
age
29186
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
nqHYQ5--JhyiRmgOAKrsq_1RArYW5o4b4Sj1Av_Yd66NYa2FjCXigA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 5491 		43 B
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=bf70
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
EWR53-C2
vary
Origin
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
x-amz-cf-id
yfavigL3uc8m-2ld1aYlPPH3WptPVTAKRcXLn-OUW6gRsp7BaesLgA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame F0A3 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=tradedesk01cont1&js=pmw1&base=te-clr1-bdcabb12-f445-44bd-955d-a8f70b4110b7&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
8e2f82ba358ede9370ae2bfe07ad79e6c9aa533ba777cb617199ece8e4b4f2aa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 21:42:47 GMT
content-encoding
gzip
server
nginx
age
14518
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
content-length
2413
x-amz-cf-id
_NrM545_ZPHUmKrD2NJ6V76u5n8T2_sCq76QO1n5LRYvBQpNhNprLQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame F0A3 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=tradedesk01cont1&js=pmw2
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 17:38:19 GMT
content-encoding
gzip
server
nginx
age
29186
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
g97iCA57aO3v3hUbY8redJSYBcuoqPLRlrAjIzpDit-E_PLJOfqxlA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame F0A3 		43 B
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=f3a2
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
EWR53-C2
vary
Origin
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
x-amz-cf-id
DuoNs6PcKQFCWiqZF63YRaAJtsKrYODecgu11maw6c1S_1XJdFm49Q==
expires
Mon, 26 Jul 1997 05:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 675F 		0
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BFu2RhxmsYeuHMZqKoPMP6I6kmAoAAAAAOAHgBAI&bg=!CQqlCk7NAAaQHwIOkB87ACkAdvg8WrO2izjzCFZrN0FOsayQxu8nnvMla4kvpWNEUygqSdx0NkkWhwIAAAP7UgAAAQNoAQcKAFkYc8tScDvV8zOJsev0yAVR7TAcEuNA27v9DWdS9lODlZX2_AKpMZobEioQJI5hxAfYalKnoqc3WFhOaFOMY6W-SCpidLtAt7GijWF6I9Ug4itC48z3k65JFJkDDONIaD1hFdhpGpyxij8WRG91EdOtcHVbk97A-Rp5aATqFtVH_-v1eUtA9B36jy7KSQT-vTPaZ6tRpsn9R5mmVS7RSFUHfPvqNV_mBKutH755nt3UgnZkF1ArzHYUCPuGdkwkBKHy9PwMFdmyQbQijVewVzuf9NQINnK3_c4F0jyIqKVlFfEmHCS-YnbF8h_qwoIuLHwveAMm6YcU1hxYtBrasB8cAp-liqRgIOeuidykJb9BVyLT5qvgB7FMeOm9lDjoCqduyP9iyxigqsnZim_qoKK-eDbng-neqrx7nTJbrH_RnPJ_WdH5XmbYkUA7S4AzDvG4eHwLuPKkCKgqLN8_5eXSB9M3vMM71c3BmTgRWpE-oje5mznB9bNESDTgu7So0_A12Ec5aKqVkU354QkM9YDHmwaAqAmAAT-DCL06CzHF29c5NcfhlEYh5Pq0PduENM13PfZOejtPBWfO-lvOZEGYj99kT87pijxrWmxzSWeubRB6ZAcq6JVsMzVrlPwPZplNzVcMywjk7gnx6vEYGvbFlLwRhINOulI7nPUQ5rUDOOBBR4_La1mh0Pv4HBdvJv9-yWheS2O28KH0RK2k-tJsKIgRgA_ay6TPwNyJVOdlPPnrkjL7dhbZkwKBVOhdJxNagLOCVg4POr6aAYdD60UFQ9YKA6e_tePorEnWJubeqVighWuGPQCWIjFv18BRAPy9aon94ThzMtUyNuG18hYUpX93KZw0f-BygYqod3kGmMYXadlpbX3p6ZVjSbxFjycP7vkku0a74xa9hJwHpKlj0A8sj8LlTVjPR99Lk0chGiz6-sVlqqA-3MoaU88fMcIqf7FQ57TRYko7dqJbM-ont9mXhbR7m4RH5twnS7vavA4ST0j4bg3RwgHMKqQPh7S_YLmEx1HzBfhMIpH9n06yxOmYE-fJmM1p0mS6lewU9ov2DOSyweSnzoeSaECzYb-3QTLIa0M4sF85Bkbz9Ys3WjZ0bJccjOa32y99qMD_l2lczLv9NZEptMY8CkbJUDlopml0MMpyQA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=10&f=0&j=&t=1638668682534&de=747971473107&cu=1638668682534&m=1457&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=804&lg=1&lh=226&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A512%3A512%3A0%3A602&as=1&ag=1443&an=1176&gi=1&gf=1443&gg=1176&ix=1443&ic=1443&ez=1&ck=1176&kw=865&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1443&bx=1176&ci=1176&jz=865&dj=1&aa=1&ad=1201&cn=934&gn=1&gk=1201&gl=934&ik=1201&co=1201&cp=1180&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1180&cd=865&ah=1180&am=865&xd=00&rf=0&re=1&ft=1201&fv=934&fw=934&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&ti=0&ih=1&jk=-1&jm=3&tc=0&fs=195402&na=1994956449&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:45 GMT
ca
choices.trustarc.com/ Frame 08B5 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_oybxzi69&w=300&h=250&c=tradedesk01cont1&js=pmw1&base=te-clr1-95329202-3765-4d32-bed4-96aa254e07f9&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
f535d78d3a2fa8b7b96a666e3df3522d5dc7bab2d1d0dd5b82e1348b666fffcb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 16:46:12 GMT
content-encoding
gzip
server
nginx
age
32313
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
content-length
2479
x-amz-cf-id
ZkAXbswLHmucKRJDZKA2gt8JSiOA5ikjGKuYJxziY7ZYmyNs36E_Nw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 08B5 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_oybxzi69&w=300&h=250&c=tradedesk01cont1&js=pmw2
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 09:41:19 GMT
content-encoding
gzip
server
nginx
age
57806
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
mreVOmvC44mU3vpAVWAj-6ZUB0FYfJ5K9z6C8YMjHehZLbSnwb9DVQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 08B5 		43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_oybxzi69&w=300&h=250&c=27dd
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
EWR53-C2
vary
Origin
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
x-amz-cf-id
Ti7A_hDJc3Eh8BtZHO84Kbv_I8Q494Bi6eKqnnk5GXTm38FCHtkNgw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
async_usersync
ib.adnxs.com/ Frame F6ED 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:45 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
a823eeb6-48f7-4ab8-8ac2-b41bc44dd29e
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ca
choices.trustarc.com/ Frame 4248 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_8334xbua&w=300&h=600&c=tradedesk01cont1&js=pmw1&base=te-clr1-ae3588c6-820f-4537-930c-28eb1a4bb08b&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
0fbc13828b69cb6d7602d41ad5469f89cae9c180674bac46caca957992d09899

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
content-encoding
gzip
server
nginx
x-amz-cf-pop
EWR53-C2
vary
Accept-Encoding, Origin
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
2382
x-amz-cf-id
KDTTrCHnRNSYAAMXwu5sHMC_W6jfGhedqJb9Z1T3WC6qUlqzOxh1Yg==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 4248 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_8334xbua&w=300&h=600&c=tradedesk01cont1&js=pmw2
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 16:33:24 GMT
content-encoding
gzip
server
nginx
age
33081
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
HJWsNdJzoFF3mBKLjLPlVHxVlqUjCp-AutO-ytHgZ36FYW0K6afKmQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 4248 		43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_8334xbua&w=300&h=600&c=fed2
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
EWR53-C2
vary
Origin
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
x-amz-cf-id
sYBlXEc6TdQWl4lBQDdn7IYvPiD7-7p1Iu2_61Xh8frJtHHlnqHBSQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
async_usersync
ib.adnxs.com/ Frame C3E3 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:45 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
2ec75e0b-f282-46bd-95a1-4e3c87fcbc58
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ca
choices.trustarc.com/ Frame ADE7 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=tradedesk01cont1&js=pmw1&base=te-clr1-bdcabb12-f445-44bd-955d-a8f70b4110b7&sid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
8e2f82ba358ede9370ae2bfe07ad79e6c9aa533ba777cb617199ece8e4b4f2aa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 21:42:47 GMT
content-encoding
gzip
server
nginx
age
14518
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
content-length
2413
x-amz-cf-id
fK-jJxQEICi3BDCWRd-RgV0EIC4ip4QUpOM5lXCbNe5h79GI0ldVDQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame ADE7 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=tradedesk01cont1&js=pmw2
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 04 Dec 2021 17:38:19 GMT
content-encoding
gzip
server
nginx
age
29186
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
2xH1DIbiO3HXDlFg0g2kX8ok3DUdqhZfwOVPiJZAg8lJMs5tIKnCww==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame ADE7 		43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=tradedesk01&pid=tradedesk01&cid=aw2wls7_vpjkvsm_lw2q2t7y&w=728&h=90&c=2985
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
EWR53-C2
vary
Origin
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
x-amz-cf-id
r4Ass5aZA-UKIqA5JsfRl-Jx-iTVT9N7UEIK-WBgb59onCXhapeX3A==
expires
Mon, 26 Jul 1997 05:00:00 GMT
sp-frame.html
tag.idsync.analytics.yahoo.com/ Frame 1671 		8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tag.idsync.analytics.yahoo.com/sp-frame.html?referrer=
Requested by
Host: tag.sp.advertising.com
URL: https://tag.sp.advertising.com/sp.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.14.41 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (chb/03BB) /
Resource Hash
e3ff3a3ce46613ebbf6cf9d70af506779dc37897b6c32c4435853672cb00ac74

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

content-encoding
gzip
age
183
content-type
text/html
date
Sun, 05 Dec 2021 01:44:45 GMT
etag
"324f9bb044d7d71fa083c18b96aa4662+gzip"
last-modified
Wed, 18 Aug 2021 13:17:52 GMT
server
ECS (chb/03BB)
vary
Accept-Encoding
x-amz-id-2
c531a60uuEfSPm+QW0hOPWsVOe/6v4FP1tw9nM2xXbrPvCzboSdsNdRy/sI2OxlA2P6NXuD9F7E=
x-amz-request-id
3PXTTQYKR0XC7K8F
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
3220
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1638668685126&de=307712184409&d=148%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:45 GMT
get
choices.trustarc.com/ Frame 5491 		287 B
630 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
6nBiDIGPDVEv_5KQNPPrCC9R6y6WXY3p9iQ3x4X8tNGPvLhPZcqwNg==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame F0A3 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
SDJgn7kA0qdJ15Cj_GwvxFDsP5VFo23aiAv9JLqezHTvo1W9uoXOxQ==
expires
Fri, 17 Dec 2021 08:04:46 GMT
users
dmx.districtm.io/s/v1/ Frame 381B 		0
686 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/users
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://cdn.districtm.io/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
DELETE, GET, OPTIONS, POST
access-control-allow-origin
https://cdn.districtm.io
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b8997541dbfecfa-YUL
access-control-allow-headers
Origin, Content-Type
users
dmx.districtm.io/s/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/users
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://cdn.districtm.io
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
cf-ray
6b899753bc5d7133-YUL
access-control-allow-origin
https://cdn.districtm.io
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
access-control-allow-headers
Origin, Content-Type
access-control-allow-methods
DELETE, GET, OPTIONS, POST
access-control-max-age
14400
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
get
choices.trustarc.com/ Frame 08B5 		287 B
626 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
b70W0jc2hHHoroc_USdYn2ntI1dWu5GOoABur4c9TJA6jLlDGHY2jA==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 4248 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
HiVWsJhMN7pjov2FW5P1Y2cmGgXpv1kupFpq43EkpQy6VqzoVShGjA==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 660E 		287 B
629 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
OvCVDj1Y9idfQXY-5jhEHyQQANimOLSYJTnrPUnwFyuzBm79BWBdMA==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 660E 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Nov 2021 10:31:16 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
2560409
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
739
x-amz-cf-id
mz7E9-2wZvAF0eiWccZ2ZghpA9XXobYZf_XWTiVrt89M9mdB72ErNg==
expires
Sun, 05 Dec 2021 10:31:16 GMT
get
choices.trustarc.com/ Frame 79C8 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
QxQ0GtRxe17hT1KMgmFe5JhjsDPalZZwLfTXjA5ocdtr7RobqGzGCw==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 79C8 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Nov 2021 10:31:16 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
2560409
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
739
x-amz-cf-id
JURo7QOl2u5dYTMpYB-YJVHD-Ym3cJdPhGUnKtxj70nyoHQDnoJ84A==
expires
Sun, 05 Dec 2021 10:31:16 GMT
get
choices.trustarc.com/ Frame ADE7 		287 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
TrpvJGaslahfr-S42AcKWr10PwpAvv6mvosSdp3NC-UxY0nPszOHjQ==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 1203 		287 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
zTUoQvV2eB910ngo0rou9tugNNAQhyUdwlaAG7g1yPtdTWQzuR_Mzg==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 1203 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Nov 2021 10:31:16 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
2560409
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
739
x-amz-cf-id
qCteZeIhYHmNWYAN2X5aWF-YGz_mfLIjXD0gPlR3l4HYAcoC49yahA==
expires
Sun, 05 Dec 2021 10:31:16 GMT
get
choices.trustarc.com/ Frame 08B6 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
lw9LtdR6OjS0Vm5E9HAFlzykhicegQOxdtHwOEC6QRzQcXGC5fyc1g==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 08B6 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Nov 2021 10:31:16 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
2560409
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
739
x-amz-cf-id
zk3RlRNDEKS5qPrdPS5BSORcjIUQxkr5JWJgvX8QWHuveHaw6vKndQ==
expires
Sun, 05 Dec 2021 10:31:16 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2457 		0
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BeZibihmsYfbSDIeToPMPreCM-AoAAAAAOAHgBAI&bg=!U1ClUBTNAAaQHwIOkB87ACkAdvg8WtMzixjbF6MwOP9RdmIrlw12KRr0UQ3i55R-zLcBK6PZXlDVWwIAAANTUgAAAMZoAQcKAHSUyhldpKNy0gOz-zILF4csmV9hSBKMh3aZArKp2oFKJH1wjLsHBTjOOCpuwYpFRWJBAhWUfHdi1-W5_iZKRSczacMieO2_QAfKg1PEfxzF5mZaNuF8YJCzx6SfGNfpm4kXp0E3uYlBXKPtXCU45fKFEIRdT5kC4jiY2kNxkAUhowc_BKZY6HCYh7CTLUOXi-4lf061dq8wn_3gEe8M4BnXXyXyw7-q6QDgejNaOcHiqNo-JiBuynRBRQPTpXkb63-ZN_SbYhK_ftCP3_ZaXF6jYhNvojrm_C97AyKeMcj-aG3b81X1evg6F0zqkbdriHdEgMQxEAFBEsTWmEb-mGAskfLIt2EIM4AjpITG836UnsLV_IrFOFJcL-hdXMBrqo8N1navCYuDg-jjlMiB95hJQQimPDDK0wOVQjQAN01EcqZUuNheiSRZuUrxDnTSMuceFpo819h84g5mt90mgFsjc-HwHwEhkvharXta3zl22MoARiEBaqMhT9GD4Uhqxaq0M8pPili9N_6C9E5HalXH9f60wruTR3PFzZO4WPfkrQzJG0DSkmyzQHuZqS5jBGM5SEggIRrqfwkTD6CZdmW4JGr-Fo01bRZ2YloihWPaEvGdeuIDRy69ImYXCAvbRYV5vWMAAG-TrGPsOSk0dP8uJ0youx5l1RJxRd9NHXdREqO8e2GMfylsvuLfQRSZqYZ7ewu_l0I8OInYmFFWBUoNMOpceoub4hhddgPeZCeqn-jrE2AKAwMGrnjYPqD9T5mstQ3SyRVweaiE27LysoDwzbm5lgrR0lj64KBEuuvGuxQI-vi8lxbEbhEFSwZIj3HUpt0keD452hjmUg6SRu_fDr8XeXql_5nttxwFwwjjlZmDD_9btE3v_DLkZ2t6k5SS7wy1CJ7Nu6T-NqLLvSk6xDdljdzEbZvN9T_CICqGC8JsMYGTlWCto7GQ1TFmb-GNR5-hX36fif6gplhWNmFld212LTuriuf-v_JE1rzG1xUCrmnEECiBbSFSDNdzh4XbNQkHUnYtuMlHW0gbCTWXLrjT3hPLnuanA2PtO91KunlXcev6z2cpiRPyO7G5TzMZAriBYhxIZZdudqBHr0ZgJ4pKzG3cveE7fzYbhffN3on_kL8s2ZCNsA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 91AD 		0
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3SyoihmsYaHSDKqCoPMPv_CksAIAAAAAOAHgBAI&bg=!ammlaS3NAAaQHwIOkB87ACkAdvg8Whr_C9gIDZAYV5UoH4notuW-q1xogUlRzvXcZKg_iAvLqvFdBQIAAANKUgAAALdoAQeZAts-uk7Pu4rD8tbCfJvLwx1jws3LWINwc8-OFLCCQ-cVmKrPSL6N2IS5jkT_ZOholp-ThN9rN9C4TdPe_DJ5A7z1dAbMH9Udj2EZjmPVQb2nxME5nr3IOtYe7X71_ULKjYqdclWEPWCxJLlVc2yJ1WAgFwbroMZVnjX3XvtDYb6pM9Y7xB3ZQcdQLKWHBcfnO8P7YLBbaXGpsGfw_Vu7PwzT15-ZpksptFRGD9lrfQDLUVjntHbIAX7EDaCyqfupZYYYUbTyrNhFxJnMEKxst0NO8h5Hogwd1hqqgo3G8ztW_wI_z6OKKB6PrObfh7rZnXsFdGb9lwPxIjlY3Wd7WaU9o88DcCOoOIIaBKDQi2vJ_5bwAB4zhzUzK9OkM400W5s0EI7l59pxOD8nyd0B7ytq5dFG5pWtHENxA2rXeJ6d8igbqs-Yif-V9GtKC3aWu9LK5sG9godjApN4ND24AA1_Jndz2PXXKBRZUTtkvWjAECAudoTaIpoyDXIUX1BOTDlmBf0shAXQ5PXEiKoj0vgUkI8EfDEd-rb5Fmqr-QFLGY397ziaS7jM2W-qisYdPS1SQtXXW65MZikyPCXn4SNeWEcLzVktv_VoGsQsdhRPkd58KSn_XadLoFuCu6gj3gRnrxZW3TKqwoG6sPCP36vgA-eTwAwB64SSc5EOuXaUl0xIqeqFykwpTcNXZYQuBLwlimY1Q16FXHYPKLRSsR-FW9UeZL5yBOKN6xM-FkCK2Oy511CDJ4fN4tHmuw9kTIq7q2digySokKabkTA4Gb6ypuzzNonhN8Nz_6L0Zq7tXdDA5lC9mVnwn_qhrrsfCie0o-SxCW3UQDjAP4GORNFugzkfctQCPVqqHpzcKYxRrVVgYZaxqT7dncixCSdNOG-8nAWUb5UlbBKCkMbI0b-rIhb6NUhIU5CVabqdT0TIR1uAgZkBVuIAqM6kPn1gsKYo3iLj-3u4HTtwqA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad-engine-response.gif
trk.vidible.tv/trk/ Frame 8210 		0
0
bc2
bc-ssb-cle.springserve.com/ Frame 3FC7 		20 B
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bc-ssb-cle.springserve.com/bc2?r=d72ef7f9-6497-4ba5-8f05-192600987ca5-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=834
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.161.24 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-189-161-24.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:45 GMT
access-control-allow-credentials
true
server
nginx
content-length
20
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
sodar
pagead2.googlesyndication.com/getconfig/ 		11 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211201&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112010101/show_ads_impl_fy2019.js?bust=31063851
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
514c455980c4b24e717a89a6f230a4841562bd5ffd16d584765735f982333252
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:44:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8576
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame B117 		0
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bhu1_ihmsYfu6EdeLoPwPo5q5iA0AAAAAOAHgBAI&bg=!bG-lbyvNAAaQHwIOkB87ACkAdvg8WoWj6bgC--2i_iCwOsGpcNfFkgIICLB7Q8Ggxa-kjI7b_tczFAIAAAMDUgAAAF1oAQeZAv5Fphlu8uq5YHYWRqfmLrvPfnqFoejHgmyVGY0eGH-4NepJS_JXPXbwenhmvYNk_8JpzuRa_nhN2xZqmQdQqFtA7Sk69n_PH0arSoFPfKvtob0dxHnATS4mkUKuKvzE11hheaTHA1HbQfuheOziudNiryK1qsFTduoSysU5yJapmFonIvqYNOzPZLMnlP-XN9o0nQrtMhxbDWesWZeCkAlUWVtZ1vdHBqE4U732-oYAId1QCN-2TSCiIIlOtbXV8hIPNpuaJR3NREZ_w0t2Z3waAaapogvC2-vCJC1S7JTbppVvSkjav1Zn6PqAoCCchEmx-9EyATZyWkPQjt3soP5lpRtA2RpHIfluk88VvWzM_YiPK3D4QbwFPddzhpcmp-bvT60M1HyuFODmkwJA10mEx1HO9_H3qLbv_q5CstJu2ZF9OO1N3feqeC95hdgun5NKK64U8y9HdKmbtXCoOFchnERDISKebGDHzMBUcQch7lPG-eA4n5H09GVXsKqmBu0sXBJ5xqtXjXR12XbUvwXqSWrUR2J2eN0LEk_WiHR9Z4MW2x-Wz2j4iE8MqVo1omfldDwTKyKZJfxkld728z17UvyFDpxdHiPt2XaeINgXREZQ5wZfuU0I2lEuP2I5hjrkj4QIpj1w9dEDdHtg1rzLwp88vIJJi-59crrTqgwnFmb2OMNnh-FlU-LnX4soBh3amUzzvtlnw-hSsV85geEqfwnInhnBgWxn2demVz28qpl_2gDzPDsSTKBGwPWMH9Ue-3pY2JBTwDfriFFxgPLFj0e4w5xtl-E61fmMhnP7TsfWUsTbohIus0se97Lj2ecQGxADNOTG34jRwKn_9bGITw1NAhQft8neDHbsBI27hnJag5ROjKiy2hNUArFHAm6RaSOxYUjfB7cvsZQJ1IjlK_s5Mv_s4x4rGpfiPy5tgfAmsVw0m-JeWoiWX21njbJgxmZwmlGpoQSDn0JZKVphK0ugzGWtre5h7A8gosN9LgAN7w7i2v848ijzjuck
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
www.bleepingcomputer.com/cdn-cgi/ 		0
253 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
content-type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
6b899755ad937156-YUL
vary
Origin
rum
www.bleepingcomputer.com/cdn-cgi/ 		0
78 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
content-type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
6b899755dddb7156-YUL
vary
Origin
rum
www.bleepingcomputer.com/cdn-cgi/ 		0
78 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
content-type
application/json

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
6b899755dddc7156-YUL
vary
Origin
gen_204
pagead2.googlesyndication.com/pagead/ Frame 014D 		0
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9v1MihmsYdmSE5qLoPwPuNuUuAsAAAAAOAHgBAI&bg=!PD-lP3vNAAaQHwIOkB87ACkAdvg8WmWmKJn6coTc8iobIldOUpW-nOqh0DjGiC0U8pVy83Q9Z17M1AIAAAMzUgAAAFVoAQcKAAJ-BpkC6HQFXPEjt4MRRurpFGMg1bPOLMI4tfxeF91IFUO6ZVT3omL6BvxUakSHLJ0c2bVLVIN6shSxjXInNLarENgveVpuHQnZI6_NxWNXOj2R5nhMALm7bYBunwKtPm3vLnmPgSIZLDsymQKeDhaZRpwHYrTVDRLsIjQ2urh6CpXGBKZ2VjuysuU8dqjjpgZiGkl_z8PdQmKwbBmnzeoqe2kSTtad_2D7QWcMHTeuXOFrnakgKeuCrllfpecF6S2H7SlU7-NDvWgQjYeJCDrjv1k8lMbwnwj1Aew39japZoUC9Hml0WWek6e8UC55EyLwfMu5wB8luMdCVl-UiBvtjW9-pahQjbmBMc87AO44LrvT4ho0vMNNk0zIL_xLvZQVfwcciTq92tezmy8Pmhv0ynQzv0s6lYnzoORMhS7LhIQfZ2SjxAA1ZYRF7_zvylaYeUDxoHe-aQMoRPRG70hVPVICzLlpMtZbkC7EgBm6eNqY5raClH_o-DZfKzycVYMDUEpl2L_ANDescrNdT0xZnbDxTN_j-O3DmNZJWFVPfvIoBHTFQAej_h60FqaC9m_QfyX3ALDt-0ObaRhNb6nmZznl4VldnASftnR8DVO5j3FzG4G9Oqxfd8hvJZK6T2Qlfr0LFT7FmrnbZD33CkDBo7pqPkT9DRgmXe4wBrVXuQY2UaK83u5o3lRJOL_QIvvDUfr0EhRwIRO1699Q-uEeUIDyOX0a8BO63VOl0purscFvU4x5Fki3ZUgFITOK03W9ZuLNGsG1ThMC3Yr3eSGqE1TFWROfxqjbLcaIyY3ufrh6NoOYMhLkBMGGCdMU55jyk28Xqspd9HFUoo5QQPggZKNhTDAZNG8BGIaSXz0cxy10NQcatcxWc9QHFEjbjRMRNpSUlvTKBFfgXb2_6yroKi8hwLNyk1EcxL1v6TeUkDuw2p5Wl03ARRy4__qW9pJbL05LHYddn7xGLXlVD_d81I_6fG9XhE4iB7g9cg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
get
choices.trustarc.com/ Frame 84C2 		287 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Wed, 17 Nov 2021 08:04:46 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
1532399
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
287
x-amz-cf-id
jw6KoLcaedjlUUE2_ZrR7YAIaUqzowSJLSaA9fbclc0kVJ1Vux6Xow==
expires
Fri, 17 Dec 2021 08:04:46 GMT
get
choices.trustarc.com/ Frame 84C2 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-126.ewr53.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Fri, 05 Nov 2021 10:31:16 GMT
via
1.1 2ef71b29bcfbfc8755cad5f92a3c329b.cloudfront.net (CloudFront)
server
nginx
age
2560409
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
EWR53-C2
timing-allow-origin
*
content-length
739
x-amz-cf-id
rw_lclcExQUu_QkDposYZYWrtcxLbgLjoJsGWKBqNIj6pIrI-eKsyw==
expires
Sun, 05 Dec 2021 10:31:16 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 05 Dec 2021 01:44:45 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 4B3D 		0
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bukp9ihmsYaGDFI3s_gSFrbnYAQAAAAA4AeAEAg&bg=!1Nel15PNAAaQHwIOkB87ACkAdvg8WvIxORmk8_Ry2TvF0qdhM9uWQ8yvdMUtHMKu_zZJf5zl1HVG0QIAAANiUgAAAEZoAQeZAufkskqaDOKCDYWvG4gKMNZqVmmEKuZHFAQIqTKjlFMtV_iFjJlDZ4kC_CJXvc1Pk8LFVvyMNDxg-QCOeQY_kLxj9E2AfdCbIqe_BQlADTaIJ4mB2pfkMOjPk6LrcWJDhQGB6FITwMWRtBnktg04lbK0o5aZwCS6ESzvmzbtuwA71lIGyqslMMHbNqcUW1QEwfmS3Sk7vxTcL8Qa_ZVx3PmWGLxAJ0l_XFmKxi_cC3x9X0meJDoM8OAHhWl2t5IHSMfqs0B-Onp3UmXZMFUyeDMdLrVLEVXvCKAoLl3sYm1BAoLG-Ej7oz8sQzPe7Mh687_DpC4WU_yD4wySqGAbPPd088U46lD14Go_9jKsK0UlOct2BzOs2NXKK19L0f-zSj31TMtgoKa5yA2NxxiPYmkIyHQT0ys6kRC9LT_wt8dbfOFuj-1Z_QCzzW6_64TjIeQMQBaW12MUsS8frveIK2kgQjMQXWNneFC3dQTl_s2dRPd00sGqt9IbLm68P__t12VR1MJf1-vQpetY4hBXbqJ2i3ITGgK86BEyw-YvpClrq13Z-ar1IBhcsS4t4c9E7M-H4QwAIpvSQcjW5pdDMBkxgeWRAKejNexkmlcGuBJ9Tzcjx-4WvIK42XxCJJkK7IfO0fFp3n6Pk52Jg4X0vv488Vrgl-NZCcs-FoWWN1pEPqx07ozzsgtpHNOp_B_r-_IPfGhl9OC7YZyj21uGP_ML-oimPgrwUchsq7W4hg9MNKLyGicZy60kWZqGyrveMMHZTAQZbmZiQbUOKS1MBso_uMh4OD6ZfxZhCC2T39cwdb2iOj7ds54JiHkOYfHuhCnyhT8aeSImvpUVVVnGWakx5LPSqxL_lkuL3gj2Ja8-tSCjzrx0xw1y-q6rWdB7FL0GHPkZczYZ4EAFRKRX3yKMXaLkmpkSpiKbVVsbOpqxyrfJ-LkqY-_SpdK85RrubpPiCIwxORB8ICNiYw6pE7l_sUU8F-nXjg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9165 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5046
date
Fri, 03 Dec 2021 18:15:28 GMT
expires
Sat, 03 Dec 2022 18:15:28 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
113357
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 1853 		783 B
536 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
c8e01036126483d4c573355492a75ae65ae1722e9a927d41d9da4fafc8076612
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-6vBXgv1YseYWA1Kh2px2RQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Sun, 05 Dec 2021 01:44:45 GMT
date
Sun, 05 Dec 2021 01:44:45 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-6vBXgv1YseYWA1Kh2px2RQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
514
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 9165 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113357
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
sodar
pagead2.googlesyndication.com/pagead/ Frame 1853 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20211201&jk=3364310970517454&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
i
vid-io-cle.springserve.com/vd/ Frame 3FC7 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid-io-cle.springserve.com/vd/i?suuid=d72ef7f9&ps_id=514171&batch=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.19.190.206 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-19-190-206.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:46 GMT
access-control-allow-credentials
true
server
nginx
content-length
0
gen_204
pagead2.googlesyndication.com/pagead/ 		0
24 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20211201&jk=3364310970517454&bg=!r6ylrOjNAAaQHwIOkB87ACkAdvg8WjufVDE2JB5JPprhCugcvhllwaHef13XGAmUq1WD1KdYtmGLbgIAAACSUgAAAA1oAQeZArXUUwbmd7IBp332cB34s7MrH9RJy_mupczdPSWJ2wkbEa-1_eiQ-l6KoPQuGbnaUmX9hC21tfvrCU0G92vdmtEOVqAb5zsPZ7HbcGflK1hMnt4ROpm0trbrWQQNkhAz34K6MB4PhM_T7GEWYbssfOEWmPruSDiNnL8mrdc-c2H71vAvo8KRR-wf_dLzueGb0v35kYWNpFexTX5n7N98E8QfcGrohkwRvQWQ3V5P-6zMIZ0hEuv5otJIPFA19tHNPAXprWZDgNH6IFoI1hO4BP2qPIoqnMlWUL5NuVLW-BoSWSFNjxDYgnQ3tfeYEsEY-R40JkLMjO83lE6kV9ah8uIhPV0J1JPGKjAKFuIG16FyyZqES672yR6oH5kzNYIk_j_xgmUzmPLAqvJuHzl6y-FHSGTr7EGGr8JhkmmL5cVGgI9w_UXBYglzzl20l8ISSC2d67c2lBijuC-tuaeY4CRjHaWcRVI6dIYbknAsU_HHbS0AGWUtOI1HTMelkh2oJ8GrO01s_6N4b-M_KThPH0lsNyTGIW6EXX7ceiou_EPP-qnlR7js6f1EbWsbXT9ZMcFFpyepsA8Y7HouHA12TalV236TpQSMADglEXTdweauiC5gReHw-gyBf2MvyNQzDFvtaVHsf9bD4LikLIQshxyNEfHXZFaW18BZvY3zzEEvz1k2mqjhWjMpfFR-YgsBKTOutFH5TmQhC_Znc_bczTLEdo-Y0GBFV4A74mNvAV7pEiRmmHtywAx-U2AQnzUaQPi7XuFVW6NrNW2_fA7uDXGIsRAjWGI6aekA-1bF4-uHGhDEl96MBtTt2tijY4MflbCZhw6kHbfjEKtu7DWtvfwAtfvbzP2e_l_eRB4T9KTT31iS7zViVz9uZbYYN13x0OYktqsHt_deG7A_VoC62BvbnLbO2ck
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:46 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame 69CD 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156696&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:46 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
abt
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:46 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
g
capi.connatix.com/rtb/ Frame A266 		549 B
805 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/rtb/g?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
6ce5751b03dc9efbe605ad6fbdc4c9e90ebaf600a62859d4b5e4ef3a7c35fd4c

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:46 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
549
content-type
multipart/form-data
PugMaster
image6.pubmatic.com/AdServer/ Frame 3938 		47 B
226 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=64412942&p=156696&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
09343d3b3473e1c994b2d603c99feb8a0f63fbd3ff20be7432ff18b973dbe651

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:45 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
47
content-type
text/html; charset=UTF-8
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=8&f=0&j=&t=1638668682370&de=446533987442&cu=1638668682370&m=5282&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=911&lg=1&lh=234&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A512%3A512%3A10632%3A602&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5066&cd=74&ah=5066&am=74&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=830023&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=944e8539-133d-4ade-8716-db20c61496c3&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD05NDRlODUzOS0xMzNkLTRhZGUtODcxNi1kYjIwYzYxNDk2YzMmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02Njc3MDgzNzgwMTQxMjc3MzMzJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfMzIweDUwX0luQ29udGVudF8xL2JsZWVwaW5nY29tcHV0ZXJfNzI4eDkwXzMyMHg1MF9JbkNvbnRlbnRfMSZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&ti=0&ih=1&jk=-1&jm=1&tc=0&fs=195402&na=287609802&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:47 GMT
/
insight.adsrvr.org/enduser/moat/ 		0
100 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/moat/?e=61&o=dD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:47 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=10&f=0&j=&t=1638668682534&de=747971473107&cu=1638668682534&m=5153&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=804&lg=1&lh=226&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A512%3A512%3A10632%3A602&as=1&ag=5138&an=1443&gi=1&gf=5138&gg=1443&ix=5138&ic=5138&ez=1&ck=1176&kw=865&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5138&bx=1443&ci=1176&jz=865&dj=1&aa=1&ad=4896&cn=1201&gn=1&gk=4896&gl=1201&ik=4896&co=1201&cp=1180&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4938&cd=1180&ah=4938&am=1180&xd=00&rf=0&re=1&ft=4896&fv=1201&fw=934&wb=2&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&ti=0&ih=1&jk=-1&jm=3&tc=0&fs=195402&na=1217135995&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:47 GMT
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9ef1eab2-63bf-ab8a-ec9f-720656398207&tv=%7Bc:vSM2du,pingTime:5,time:6898,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:38%7D,%7Bpiv:100,vs:i,r:,t:1896%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:5002,o:1896,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1890~0,0~100%5D,as:%5B1890~728.90%5D%7D%7D,%7Bsl:i,t:1896,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5001~100%5D,as:%5B5001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:true,e:,tt:rjss,dtt:205,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n*.877959-58497149%7C1o.877959-58497149%7C1p.877959-58497151%7C1q.877959-58497147%7C1r.877959-58497149%7C1s,idMap:1n*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:48 GMT
x-server-name
dt19.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=877959&asId=9ef1eab2-63bf-ab8a-ec9f-720656398207&tv=%7Bc:vSM2dv,pingTime:5,time:6899,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:38%7D,%7Bpiv:100,vs:i,r:,t:1896%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:5003,o:1896,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1890~0,0~100%5D,as:%5B1890~728.90%5D%7D%7D,%7Bsl:i,t:1896,wc:0.0.1600.1200,ac:436.226.728.90,am:i,cc:436.226.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5002~100%5D,as:%5B5002~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:true,e:,tt:rjss,dtt:205,fm:sQGaMZ4+1111%7C1112%7C1113%7C1114%7C1115%7C1116%7C1117%7C1118%7C1119%7C111a%7C111b%7C111c%7C111d%7C111e%7C111f%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C191%7C1a%7C1b1%7C1c%7C1d1%7C1e1%7C1f%7C1g%7C1h%7C1i11%7C1i12%7C1i13%7C1i14%7C1i15%7C1i16%7C1i17%7C1i18%7C1i19%7C1i1a%7C1j11%7C1k1%7C1k2%7C1l1%7C1m%7C1n*.877959-58497149%7C1o.877959-58497149%7C1p.877959-58497151%7C1q.877959-58497147%7C1r.877959-58497149%7C1s,idMap:1n*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.82.161.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-82-161-49.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:48 GMT
x-server-name
dt05.va.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=11&f=0&j=&t=1638668682883&de=968877376972&cu=1638668682883&m=5394&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=456&lg=1&lh=308&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A512%3A512%3A10632%3A602&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5183&cd=6&ah=5183&am=6&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=422539&zMoatCreative=8334xbua&zMoatDealID=1267594&zMoatImpressionId=a6bb0b9f-340b-4bd4-b92a-1fc651fcbf46&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD1hNmJiMGI5Zi0zNDBiLTRiZDQtYjkyYS0xZmM2NTFmY2JmNDYmY3JpZD04MzM0eGJ1YSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02MzEwODg1NTQxMDk5NDA4MDg4JndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl8zMDB4MjUwXzMwMHg2MDBfMTYweDYwMF9SaWdodF8zL2JsZWVwaW5nY29tcHV0ZXJfMzAweDI1MF8zMDB4NjAwXzE2MHg2MDBfUmlnaHRfMyZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&ti=0&ih=1&jk=-1&jm=1&tc=0&fs=195402&na=1195234432&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:48 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:48 GMT
514171
vid.springserve.com/vast/ Frame A266 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
60b3ae905684a16f7f063bb999a485205fc471ee90eb74b95f857cdd2ac25a10

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:48 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-encoding
gzip
content-type
application/xml;charset=UTF-8
vpaid_25214542.js
vpaid.springserve.com/production/ Frame 6B0C 		495 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpaid.springserve.com/production/vpaid_25214542.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:9400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 01:33:13 GMT
content-encoding
br
last-modified
Fri, 19 Nov 2021 18:30:16 GMT
server
AmazonS3
age
519096
etag
W/"185feb14359001049d144410afbeaaa4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 aa7679f2d01b23d9a66bfa6e92991b05.cloudfront.net (CloudFront)
cache-control
max-age=2678400
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
3S3Jx_9klK-tlBozixhWn8NV_1tJ-rW30-jr0j5DBqj9hGELRGfT6Q==
prebid
ib.adnxs.com/ut/v3/ Frame 6B0C 		160 B
1005 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.183 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
803.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
f6cc956692123800c8a7144ddd961da386e904a2dfe611358e068e1e08a02cf4
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:49 GMT
X-Proxy-Origin
37.120.205.182; 37.120.205.182; 803.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
ee2048e7-da2e-4305-91a2-71e743b2bf93
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
160
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 6B0C 		0
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:49 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
ads.adaptv.advertising.com/rtb/ Frame 6B0C 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
openrtb
ads.adaptv.advertising.com/rtb/ Frame 6B0C 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 6B0C 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668688908&gdpr=&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.214.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-214-70.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
3caa5b1c27ad830f58eac251b063696fca3040c81237a46ea293836d1779ef90
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
server
adaptv/1.0
content-type
text/xml
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
954
expires
0
o2shim
acds.prod.vidible.tv/ Frame 03ED 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=18f91ee7-365b-48e2-8922-e9616f032685&pblob=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.207.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-207-71.compute-1.amazonaws.com
Software
/
Resource Hash
a1e8d04c08daa0b25816d9fc58c5e3ac1444e002ac36f04ec01a20b324f8a552

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:49 GMT
content-encoding
gzip
access-control-max-age
3600
access-control-allow-methods
POST, GET, HEAD, PUT, PATCH, DELETE
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-headers
content-length
6644
0.js
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/ Frame 03ED 		319 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Requested by
Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=18f91ee7-365b-48e2-8922-e9616f032685&pblob=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1001 Ashburn, United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

ats-carp-promotion
1
date
Mon, 29 Nov 2021 16:25:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465537
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-length
104909
x-amz-id-2
ViDU7qxIVXCQ1OoL+wnEuf7bcOjIs2T7ni4ZpbYjPgnIAOe5CwvGhyqrgU0nSXPjJWD8zviCczc=
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 29 Oct 2021 12:07:18 GMT
server
ATS
etag
"ad866575d644f8b5c5d7a56ff730d7e3-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-request-id
XVSF9HDPN0WNYG5D
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=1209600
x-amz-version-id
null
accept-ranges
bytes
content-type
application/javascript
impression.gif
trk.vidible.tv/trk/ Frame 03ED 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.82&ifr=true&cb=0.0019947832222813044&pt=o2unit&sid=7b223a5f-4471-4e1e-a9ef-9ca6be0ce249&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:49 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:49 GMT
moatapi.js
z.moatads.com/aolvidibleapi29384728347/ Frame 6B0C 		133 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.114.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-114-7.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:49 GMT
content-encoding
gzip
last-modified
Tue, 25 Feb 2020 18:37:38 GMT
server
AmazonS3
x-amz-request-id
173F0BEA92CD9AC6
etag
"d678022569896f7b7293494e3a69c8c7"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=11204
accept-ranges
bytes
content-length
44266
x-amz-id-2
RklxkPdiYk8GhMpdx5iMxA7DvkiGo6tkMATS2fpRD27gNLLlz56AlUBtVoddESPwbLn/omOVHYo=
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads-ec.v.ssp.yahoo.com/a/h/ Frame 03ED
Redirect Chain
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668688908&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&p...
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668688908&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.he...
249 B
0 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668688908&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=981f9615-2e85-4c70-8d4c-a2a348e72e2f&a.is_yahoo=3&redirect_y=dHM9MTYzODY2ODY4OTY5Mi4xMzcyMDc6dXVpZD0iODY4MzA4NTQ5NDI2OTIyODg4NF9fVElNRV9fMjAyMS0xMi0wNCsxNyUzQTQ0JTNBMzgiOmFwaWQ9VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ6bWlncmF0ZWQyeT0iMSI6cmVxdWVzdF9pZD05ODFmOTYxNS0yZTg1LTRjNzAtOGQ0Yy1hMmEzNDhlNzJlMmY=
Protocol
HTTP/1.1
Server
52.1.108.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-108-21.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 05 Dec 2021 01:44:49 GMT
content-encoding
gzip
server
ATS/9.1.0.33
Age
0
content-type
text/xml
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
192
expires
0

Redirect headers

strict-transport-security
max-age=31536000
server
adaptv/1.0
access-control-allow-origin
https://www.bleepingcomputer.com
content-type
text/plain
location
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638668688908&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=981f9615-2e85-4c70-8d4c-a2a348e72e2f&a.is_yahoo=3&redirect_y=dHM9MTYzODY2ODY4OTY5Mi4xMzcyMDc6dXVpZD0iODY4MzA4NTQ5NDI2OTIyODg4NF9fVElNRV9fMjAyMS0xMi0wNCsxNyUzQTQ0JTNBMzgiOmFwaWQ9VkFlN2E2OGNiNi01NTZjLTExZWMtYjI3OC0wZWFiM2RjNDJkNzQ6bWlncmF0ZWQyeT0iMSI6cmVxdWVzdF9pZD05ODFmOTYxNS0yZTg1LTRjNzAtOGQ0Yy1hMmEzNDhlNzJlMmY=
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
0
display.gif
trk.vidible.tv/trk/ Frame 03ED 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=7b223a5f-4471-4e1e-a9ef-9ca6be0ce249&vvuid=451c17d0-2314-49ac-bec7-d81a61ee5e03&orgId=28949&plcid=1279691&vrid=18f91ee7-365b-48e2-8922-e9616f032685&ab=0&dt=295&h=469&spaceid=793604934&w=834&cb=0.821144086539908
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:49 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:49 GMT
ad-request.gif
trk.vidible.tv/trk/ Frame 03ED 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=7b223a5f-4471-4e1e-a9ef-9ca6be0ce249&vvuid=451c17d0-2314-49ac-bec7-d81a61ee5e03&orgId=28949&plcid=1279691&vrid=18f91ee7-365b-48e2-8922-e9616f032685&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.7453140999651247
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:49 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:49 GMT
ad-engine-request.gif
trk.vidible.tv/trk/ Frame 03ED 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=7b223a5f-4471-4e1e-a9ef-9ca6be0ce249&vvuid=451c17d0-2314-49ac-bec7-d81a61ee5e03&orgId=28949&plcid=1279691&vrid=18f91ee7-365b-48e2-8922-e9616f032685&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=469&cb=0.7789758050646118
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.145.60 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-145-60.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:49 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:44:49 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1638668689701&de=97293597802&d=125%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:49 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:49 GMT
6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f2d93c219f91a38a44ec42951184d4a1d9a655597f908acf2daab59e1f6be99c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:49 GMT
content-encoding
br
age
894
etag
"BJEpKQIfVk9gfFq5ybAO/aznNltgdmsHA8hej/f0qXQ"
access-control-max-age
86400
fastly-io-info
ifsz=267428 idim=1600x800 ifmt=jpeg ofsz=81904 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
81912
ad-engine-response.gif
trk.vidible.tv/trk/ Frame 03ED 		0
0
bc2
bc-ssb-cle.springserve.com/ Frame 6B0C 		20 B
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bc-ssb-cle.springserve.com/bc2?r=fef48cc3-4e58-4260-af50-b0a05d487d08-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=834
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.189.161.24 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-189-161-24.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:50 GMT
access-control-allow-credentials
true
server
nginx
content-length
20
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
i
vid-io-cle.springserve.com/vd/ Frame 6B0C 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid-io-cle.springserve.com/vd/i?suuid=fef48cc3&ps_id=514171&batch=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.19.190.206 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-19-190-206.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:50 GMT
access-control-allow-credentials
true
server
nginx
content-length
0
abt
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:51 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
st
capi.connatix.com/tr/ Frame A266 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.244.143 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-244-143.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:44:51 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=8&f=0&j=&t=1638668682370&de=446533987442&cu=1638668682370&m=10338&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=911&lg=1&lh=234&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A512%3A512%3A10632%3A602&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10122&cd=5066&ah=10122&am=5066&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=830023&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=944e8539-133d-4ade-8716-db20c61496c3&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD05NDRlODUzOS0xMzNkLTRhZGUtODcxNi1kYjIwYzYxNDk2YzMmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD02Njc3MDgzNzgwMTQxMjc3MzMzJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfMzIweDUwX0luQ29udGVudF8xL2JsZWVwaW5nY29tcHV0ZXJfNzI4eDkwXzMyMHg1MF9JbkNvbnRlbnRfMSZwY209MSZ2Yz0zJnNhaWQ9NzQ4MDQ3NDQzMTA0NTIyMDA0MiZpY3Q9VW5rbm93biZhdWN0PTEmaW09MSZtYz1hZDAzOGZiNy02MzFmLTQ3ZmYtODZmZi0yYWZkNTQ3MGQ5YWYmc3Y9YXBwbmV4dXM.&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&ti=0&ih=1&jk=-1&jm=1&tc=0&fs=195402&na=1219827390&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:52 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:52 GMT
/
insight.adsrvr.org/enduser/moat/ 		0
100 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://insight.adsrvr.org/enduser/moat/?e=62&o=dD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/ ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:44:52 GMT
cache-control
private
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&ra=1&pxm=10&sgs=3&vb=7&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=TRADEDESKV3&ol=1342002896&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(K_*%3Ce%24%26*x4PjrGBe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3FtDJq%409BG&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-pqPcMB-nMzjG-&vi=111111&rc=0%2C1%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-CxVYrdgGjXtDL%2FZR7NeP1dVlogBIfVcrVAZRAnlp9pAdeA81EcR7fkgw&rs=1-SMN%2BQlx4YxN2gA%3D%3D&sc=1&os=1-PQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4BS8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57M19aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Ct_A%24%3D!%250UnqMs%3Cex1bxNTK7%2BuCTpY%3CZ.4%5DAOTK7%2BuC9r&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&id=1&ii=4&cm=10&f=0&j=&t=1638668682534&de=747971473107&cu=1638668682534&m=10194&ar=553ffc12ef5-clean&iw=5f11175&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=7725&le=1&lf=804&lg=1&lh=226&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A512%3A512%3A10632%3A602&as=1&ag=10181&an=5138&gi=1&gf=10181&gg=5138&ix=10181&ic=10181&ez=1&ck=1176&kw=865&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10181&bx=5138&ci=1176&jz=865&dj=1&aa=1&ad=9939&cn=4896&gn=1&gk=9939&gl=4896&ik=9939&co=1201&cp=1180&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9984&cd=4938&ah=9984&am=4938&xd=00&rf=0&re=1&ft=9939&fv=4896&fw=934&wb=2&cl=0&at=0&d=3i8jb8j%3Am4cpndh%3Aaw2wls7%3Avpjkvsm&bd=www.bleepingcomputer.com&gw=thetradedeskv275874568748&zMoatOrigSlicer1=www.bleepingcomputer.com&zMoatOrigSlicer2=N%2FA&zMoatDomain=bleepingcomputer.com&zMoatSubdomain=bleepingcomputer.com&zMoatJS=3%3A-&zMoatCachebuster=127258&zMoatCreative=lw2q2t7y&zMoatDealID=1267594&zMoatImpressionId=429d09db-0535-48fb-aeef-449b1f06712e&zMoatPartnerID=3i8jb8j&zMoatSite=www.bleepingcomputer.com&zMoatSupplyVendor=appnexus&zMoatTempIDs=http%253A%252F%252Finsight.adsrvr.org%252Fenduser%252Fpie%252F%253Fpie%253D20%2526vet%253DVIEWABILITY_EVENT_TYPE%2526rtb%253DdD0xJmlpZD00MjlkMDlkYi0wNTM1LTQ4ZmItYWVlZi00NDliMWYwNjcxMmUmY3JpZD1sdzJxMnQ3eSZ3cD0ke1BSSUNFX1BBSUR9JmFpZD03MTY3MDU2NDYyMzA4MTg3ODkyJndwYz1VU0Qmc2ZlPTEzZTM5OTg1JnB1aWQ9ODk4NzMwNDE5Mjc3NTQ5NTI5NyZwaWQ9M2k4amI4aiZhZz12cGprdnNtJmFkdj1tNGNwbmRoJmJwPTIuMzM0ODU3NDc2NDA4MjEmY2Y9MjcxNjMyOSZmcT0wJnRkX3M9d3d3LmJsZWVwaW5nY29tcHV0ZXIuY29tJnJjYXRzPTJkeCxvYmssamJhLHl2YiwzZ3MmbWNhdD0mbXN0ZT0mbWZsZD00Jm1zc2k9Jm1mc2k9JnVob3c9MTY0JmFnc2E9JnJnej1IM0Imc3ZidHRkPTEmZHQ9UEMmb3NmPVdpbmRvd3Mmb3M9V2luZG93czEwJmJyPUNocm9tZSZybGFuZ3M9ZW4mbWxhbmc9JnN2cGlkPTcxMjUmZGlkPTEyNjc1OTQmcmN4dD1PdGhlciZsYXQ9NDUuNDk5NDAwJmxvbj0tNzMuNTcwMzAwJnRtcGM9LTcuMjUmZGFpZD0mdnA9MCZvc2k9Jm9zdj0mbWs9R29vZ2xlJm1kbD1DaHJvbWUlMjAtJTIwV2luZG93cyZjPUNnWkRZVzVoWkdFU0JsRjFaV0psWXhvQUlnaE5iMjUwY21WaGJEZ0NVQUZZQW9BQkFJZ0JBWkFCQUEuLiZkdXI9Q2tnS0lXTm9ZWEpuWlMxaGJHeE5iMkYwVm1sbGQyRmlhV3hwZEhsVWNtRmphMmx1WnlJakNLWF9fX19fX19fX193RVNEbTF2WVhRdGNtVndiM0owYVc1bktnWUl3SVE5R0F3LiZjcnJlbHI9JmFkcHQ9YW5vciZpcGw9YmxlZXBpbmdjb21wdXRlcl83Mjh4OTBfOTcweDkwXzk3MHgyNTBfMzIweDUwX0FURi9ibGVlcGluZ2NvbXB1dGVyXzcyOHg5MF85NzB4OTBfOTcweDI1MF8zMjB4NTBfQVRGJnBjbT0xJnZjPTMmc2FpZD03NDgwNDc0NDMxMDQ1MjIwMDQyJmljdD1Vbmtub3duJmF1Y3Q9MSZpbT0xJm1jPWFkMDM4ZmI3LTYzMWYtNDdmZi04NmZmLTJhZmQ1NDcwZDlhZiZzdj1hcHBuZXh1cw..&zMoatViewType=0&zMoatOtherScript=-&zMoatOtherHash=-&zMoatAttention=-&zMoatDR=-&zMoatPublisherID=7125&hv=TTD%20Override%201&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&ti=0&ih=1&jk=-1&jm=4&tc=0&fs=195402&na=1601873857&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:44:52 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:44:52 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Domain
trk.vidible.tv
URL
https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=1a250248-26f6-44b4-ab7c-25bf4a5142f0&vvuid=ecc4d890-33ec-4c1d-bd3f-4de6c0477f53&orgId=28949&plcid=1279691&vrid=8789babb-2040-41c2-8c48-492019dbef06&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&aert=483&ar=no&fo=0&ft=0&h=469&cb=0.39339414740310574
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5
Domain
trk.vidible.tv
URL
https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d3804f9b-131b-466c-ba0c-f99c569337df&vvuid=e7b89782-0709-4327-934b-9b3355ef38fa&orgId=28949&plcid=1279691&vrid=6afacd1e-1950-4d89-a104-277b55ddc0b4&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&aert=838&ar=no&fo=0&ft=0&h=469&cb=0.44293032217108186
Domain
trk.vidible.tv
URL
https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=7b223a5f-4471-4e1e-a9ef-9ca6be0ce249&vvuid=451c17d0-2314-49ac-bec7-d81a61ee5e03&orgId=28949&plcid=1279691&vrid=18f91ee7-365b-48e2-8922-e9616f032685&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&aert=250&ar=no&fo=0&ft=0&h=469&cb=0.2540002132882817

Verdicts & Comments Add Verdict or Comment

250 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| 26 object| 27 object| 28 object| 29 object| 30 object| 31 object| 32 object| 33 object| 34 object| 35 object| 36 object| 37 object| 38 object| 39 object| 40 object| 41 object| 42 object| 43 object| 44 object| 45 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| cnxps object| freestar object| apd_options function| gtag object| dataLayer object| adsbygoogle function| Blazy object| fixto function| validate_comment_box_not_empty function| cz_strip_tags function| cz_br2nl function| editForm string| loginhash boolean| main_nav_hide_flag number| scrollTop string| main_nav_hide_timer function| call_main_nav_hide number| cz_header_pos number| prevScrollTop function| loadDeferredStyles function| raf object| __cfBeacon boolean| fifabAlready function| fi_fab object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga undefined| commonInit function| visibilityEventsManagerDOM function| visibilityEventsManager function| scrollEventsManager function| DeviceDetector object| FI object| JSON_PIWIK object| _fipaq object| FIPiwik object| AnalyticsTracker function| fiQuery object| __twttrll object| twttr object| __twttr object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map string| google_user_agent_client_hint object| fsdata object| _comscore object| fsprebid object| cnx_usr_storage function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| addthis_share object| addthis_config object| gaplugins object| gaGlobal object| gaData function| load_script object| googletag function| udm_ object| ns_p object| COMSCORE function| google_sa_impl object| google_persistent_state_async object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages object| oattr object| fiUtils object| $customVisiblity object| $waitOn object| google_image_requests boolean| __@@##MUH function| fsprebidChunk object| _pbjsGlobals object| mnet function| Tapad object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks object| player_instance_b1c09657eaed4c37aa0257de0a23e1e8 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| cnxPlugins object| __bt_tag_d object| __bt_intrnl boolean| __bt_already_invoked function| cnxProxyTask object| apstag object| closure_lm_60754 object| _qevents boolean| apstagLOADED object| up74tG2 function| up74tG3 object| xop boolean| creativeVendorLibraryLoaded function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| audSegDataResp string| kruxScriptId string| kruxIdScriptId string| kruxDataId string| kruxWhitelistSegments object| kruxScript function| checkMatchingSegments function| generateUUID function| getUserId function| getPageId function| getPageLog function| calculateDocumentType function| calculateReferer function| clientWindowHeight function| clientWindowWidth function| getBrowserSize function| firePageLog function| fireDataCall function| Krux function| ic_krux_getuserid string| IC_FS_PAGE_ID string| IC_FS_PAGE_REFERER undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvArticleTracker function| ntvGetElementViewability function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus object| google_llp object| EE70hY2 function| EE70hY3 function| xblocker object| mfb1gT function| mfb1gf function| xblacklist object| PublisherCommonId object| ID5 boolean| DFPSFMessageEnabled undefined| moatApiInit1638668678963 object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 function| __IntegralASAdPush object| goog_ddm_ps object| DOMlessLLDcallback_95253967 object| BrandSafetyNadoscallback_95253967 number| lnt_z undefined| moatApiInit1638668684819 object| GoogleGcLKhOms undefined| moatApiInit1638668689661 function| cnxAddEventListener

249 Cookies

Domain/Path Name / Value
www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot Name: ntvSession
Value: {}
.resetdigital.co/csync Name: ckbk
Value: 0000008DA38D9B9F
.3lift.com/sync Name: sync
Value: CgoIgQIQoJOPwtgvCgoI4gEQoJOPwtgvCgoI5gEQoJOPwtgvCgoIhwIQoJOPwtgvCgkICRCgk4_C2C8KCQg6EKCTj8LYLwoJCAsQoJOPwtgvCgoIjAIQoJOPwtgvCgoIzgEQoJOPwtgvCgkIXxCgk4_C2C8=
.bleepingcomputer.com/ Name: session_id
Value: e38733770f831187916cc890bdc723dd
www.bleepingcomputer.com/ Name: lav
Value: 12322
www.bleepingcomputer.com/ Name: fsbotchecked
Value: true
www.bleepingcomputer.com/ Name: __atuvc
Value: 1%7C49
www.bleepingcomputer.com/ Name: __atuvs
Value: 61ac1983a9084e66000
.bleepingcomputer.com/ Name: _ga
Value: GA1.2.335997328.1638668676
.addthis.com/ Name: ouid
Value: 61ac19840001479fe74f75d4214a7c538b93eaccac2e7f5207ea
.addthis.com/ Name: di2
Value: aU~u]#%!k#$M`#!AgP2TIPv7LW6Lj6Hq#34Q#1:R#19w#.'j
.addthis.com/ Name: bt2
Value: 61ac1984001Fs0002
.addthis.com/ Name: um
Value: j.'2021120501443603200843131349'
.addthis.com/ Name: uid
Value: 61ac19841fa42bbf
.addthis.com/ Name: na_id
Value: 2021120501443603200843131349
.addthis.com/ Name: vc
Value: 2
.bleepingcomputer.com/ Name: _gid
Value: GA1.2.1413561734.1638668676
.bleepingcomputer.com/ Name: _gat_gtag_UA_91740_1
Value: 1
www.bleepingcomputer.com/ Name: _fssid
Value: 2c20bb13-e39d-4a40-a4b8-5f5030a4f349
cdn.firstimpression.io/ Name: OAID
Value: 65b077ba0a6c093945f069d6aea4948e
.scorecardresearch.com/ Name: UID
Value: 1WI3GQIAPTRTATT9D5HH7Yg1638668676
.addthis.com/ Name: uvc
Value: 1%7C49
capi.connatix.com/ Name: cnx_userId
Value: cee0a083e7aa41ee905839ad8069ffb9
www.bleepingcomputer.com/ Name: cnx_userId
Value: cee0a083e7aa41ee905839ad8069ffb9
.addthis.com/ Name: loc
Value: MDAwMDBOQUNBT04yMjUzMTA0MzUwNTAwMDBDSA==
.adnxs.com/ Name: uuid2
Value: 8987304192775495297
.adsrvr.org/ Name: TDID
Value: 7de5ca57-c954-4db1-bc90-ae26323dfac5
.openx.net/ Name: i
Value: 99d39462-e858-0bd9-26b3-267724a3d033|1638668676
.technoratimedia.com/ Name: tads_uid
Value: A44A121B6711404BB5C1FC98E5E2423F
.technoratimedia.com/ Name: tads_uid_cd
Value: 20211204204436-0500
.technoratimedia.com/ Name: tads_zora
Value: 2
.technoratimedia.com/ Name: tads_uidp_70
Value: cee0a083e7aa41ee905839ad8069ffb9
.casalemedia.com/ Name: CMID
Value: YawZhBbaf-sLobsSgmffIQAA
.casalemedia.com/ Name: CMPS
Value: 153
.reddit.com/ Name: csv
Value: 2
.casalemedia.com/ Name: CMPRO
Value: 075
.springserve.com/ Name: ssid
Value: 3b0a889b-c4f5-4a07-95fb-abfc02e78312
.springserve.com/ Name: sst
Value: 1638668676602
.pubmatic.com/ Name: KADUSERCOOKIE
Value: F458BC18-DC0D-48F9-98CC-615D57A2C396
.rubiconproject.com/ Name: khaos
Value: KWSL0RE8-3-ILJG
.rubiconproject.com/ Name: rsid
Value: 1|AIfsdBUH+v3fWCPuzNowDE/cu41hKaStkydRTZb1Pwh3wYWROmqPGcfOdLvaiI/PRhnCqTioDwugFijIXUmqGzTE/2wGlVwK8BMqZcvhERk6pwW1CaJBOKyTTM+KZgD/ANSf
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YawZhQAJhLX5VAAz
.adform.net/ Name: C
Value: 1
.adgrx.com/ Name: ADGRX_UID
Value: e798f20a-556c-11ec-a6a1-d15af7eee1bc
.deepintent.com/ Name: CDIUSER
Value: di_ad0001270b5c4d3384792
.adform.net/ Name: uid
Value: 4764934967218434204
.owneriq.net/ Name: p2
Value: pmc
.owneriq.net/ Name: si
Value: Q6919550771882466910P
.owneriq.net/ Name: pmc
Value: 1
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-7e38d89a-1ba6-4e9c-4ac7-655fd48f7fa0.p5qa3uNPsuLdwJo7Z7%2Fr8p34OUGUbQifAx8vv39FAlQ
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A0-7e38d89a-1ba6-4e9c-4ac7-655fd48f7fa0%24ip%2437.120.205.182.R9Abn4cvnXfJ1ogBvMEgBkl2h%2FOquVZqXN2zA0ouGUE
.adgrx.com/ Name: ADGRX_CM_PUBMATIC_BRIDGED
Value: 1
.yahoo.com/ Name: A3
Value: d=AQABBIUZrGECEHpWonZoCaYPUnJqowfxSOYFEgEBAQFrrWG1YQAAAAAA_eMAAA&S=AQAAAiaTjiPrx2QbIJAPdLLu2yU
.acuityplatform.com/ Name: auid
Value: 627775726303
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqANvqNdXNlck1hdGNoaW5nSWTMkWxhc3REcm9wVGltZU1pbGxpcyUBPmIIOwOgmGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAT5iCDsDoI90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.w55c.net/ Name: wfivefivec
Value: IoqlAHf41MTGzX5
.mathtag.com/ Name: uuid
Value: badc61ac-1985-4000-9788-0d2b1d82255b
.inmobi.com/ Name: idsp_c
Value: 2136b91a-fbec-4195-88cb-b89bb6bd2966
.bidr.io/ Name: bito
Value: AAFYaE7DWDMAACuXngi7Vw
.bidr.io/ Name: bitoIsSecure
Value: ok
.pubmatic.com/ Name: KRTBCOOKIE_469
Value: 8273-627775726303
.pubmatic.com/ Name: PUBMDCID
Value: 2
.pubmatic.com/ Name: KRTBCOOKIE_860
Value: 16335-fjjYmhumTpxKx2Vf1I9_oCV4zbY
.pubmatic.com/ Name: KRTBCOOKIE_218
Value: 4056-YawZhQAJhLX5VAAz&KRTB&22978-YawZhQAJhLX5VAAz&KRTB&23194-YawZhQAJhLX5VAAz&KRTB&23209-YawZhQAJhLX5VAAz
.pubmatic.com/ Name: KRTBCOOKIE_1003
Value: 22761-e798f20a-556c-11ec-a6a1-d15af7eee1bc
.w55c.net/ Name: matchpubmatic
Value: 5
.pubmatic.com/ Name: KRTBCOOKIE_1233
Value: 23223-2136b91a-fbec-4195-88cb-b89bb6bd2966&KRTB&23266-2136b91a-fbec-4195-88cb-b89bb6bd2966&KRTB&23285-2136b91a-fbec-4195-88cb-b89bb6bd2966
.turn.com/ Name: uid
Value: 7864110075816986117
.doubleclick.net/ Name: IDE
Value: AHWqTUk0Z-bXix9fhtwfHxTin9Mm-vTxIu3ciY8N0sdHKF2aU9JUCsB9BGCAmdOnu5k
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:IoqlAHf41MTGzX5
.pubmatic.com/ Name: KRTBCOOKIE_286
Value: 5193-Q6919550771882466910&KRTB&22521-Q6919550771882466910
.simpli.fi/ Name: suid
Value: DBE6805D465846A3966128D6AD5D95CA
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-7de5ca57-c954-4db1-bc90-ae26323dfac5&KRTB&22918-7de5ca57-c954-4db1-bc90-ae26323dfac5&KRTB&23031-7de5ca57-c954-4db1-bc90-ae26323dfac5
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005%22%7D
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESECQ-IpU7YaeY8-QgpjBoaHI&KRTB&16514-CAESECQ-IpU7YaeY8-QgpjBoaHI&KRTB&23025-CAESECQ-IpU7YaeY8-QgpjBoaHI
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005%22%7D
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:badc61ac-1985-4000-9788-0d2b1d82255b&KRTB&16736-uid:badc61ac-1985-4000-9788-0d2b1d82255b&KRTB&23019-uid:badc61ac-1985-4000-9788-0d2b1d82255b&KRTB&23114-uid:badc61ac-1985-4000-9788-0d2b1d82255b
.pubmatic.com/ Name: KRTBCOOKIE_594
Value: 17107-RX-da0032b4-92b1-4af4-8df5-46d6bf174e13-005
.pubmatic.com/ Name: KRTBCOOKIE_57
Value: 22776-8987304192775495297
.quantserve.com/ Name: mc
Value: 61ac1985-78aa6-16f52-37db0
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-7864110075816986117
.pubmatic.com/ Name: KRTBCOOKIE_148
Value: 19421-uid:DBE6805D465846A3966128D6AD5D95CA
.sitescout.com/ Name: ssi
Value: d92c1335-ca50-4f90-833a-a227baf8a315#1638668677543
.ipredictive.com/ Name: cu
Value: e7d04ec6-556c-11ec-b6dc-73502c1f30ef|1638668677566
.adnxs.com/ Name: icu
Value: ChgIodc0EAoYAiACKAIwhbOwjQY4AkACSAIQhbOwjQYYAQ..
.investingchannel.com/ Name: ic_uid
Value: ba6d386b-b291-43de-8eed-f5e6bf06c5b6
.postrelease.com/ Name: visitor
Value: c0b28e8e-dbbe-4d07-b7cb-3b1d688f17fb
.pippio.com/ Name: did
Value: 7lFWsrMKkQSTx7qK
.pippio.com/ Name: didts
Value: 1638668677
.pippio.com/ Name: nnls
Value:
.mathtag.com/ Name: mt_mop
Value: 9:1638668677
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 1923-QFKA4Uda2bdbVNnjF1XMs0AF1LBbUNbmFFMfEY-s&KRTB&19420-QFKA4Uda2bdbVNnjF1XMs0AF1LBbUNbmFFMfEY-s&KRTB&22979-QFKA4Uda2bdbVNnjF1XMs0AF1LBbUNbmFFMfEY-s
.mxptint.net/ Name: mxpim
Value: R1D531_E7994491_27E6AF978.1.000000000000000061AC1985
.bidswitch.net/ Name: tuuid
Value: e844459d-39b0-402c-bf5a-7640e7a8c718
.bidswitch.net/ Name: c
Value: 1638668677
.pubmatic.com/ Name: KRTBCOOKIE_279
Value: 22890-e7d04ec6-556c-11ec-b6dc-73502c1f30ef&KRTB&23011-e7d04ec6-556c-11ec-b6dc-73502c1f30ef
.pubmatic.com/ Name: KRTBCOOKIE_1199
Value: 23175-0000008DA38D9B9F
.amazon-adsystem.com/ Name: ad-id
Value: A0sO13NveUt7vzaA4_elgYI
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.pubmatic.com/ Name: KRTBCOOKIE_52
Value: 22772-R1D531_E7994491_27E6AF978&KRTB&23092-R1D531_E7994491_27E6AF978
.pubmatic.com/ Name: KRTBCOOKIE_188
Value: 3189-d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341
.pubmatic.com/ Name: KRTBCOOKIE_32
Value: 11175-AAAGZoispQrBKwNStWDnAAAAAAA&KRTB&22713-AAAGZoispQrBKwNStWDnAAAAAAA&KRTB&22715-AAAGZoispQrBKwNStWDnAAAAAAA
.bidswitch.net/ Name: tuuid_lu
Value: 1638668678
www.bleepingcomputer.com/ Name: _ntv_uid
Value: c0b28e8e-dbbe-4d07-b7cb-3b1d688f17fb
.pippio.com/ Name: pxrc
Value: CIazsI0GEgQIAhAAEgYI7OsBEAA=
.bleepingcomputer.com/ Name: __qca
Value: P0-1916101498-1638668678211
.pub.network/ Name: _fsuid
Value: 106dd0e7-8277-43b8-a5a0-3be16d37f6b6
.linksynergy.com/ Name: rmuid
Value: ec534934-9cc6-4add-95e8-09698ea33a4c
.linksynergy.com/ Name: icts
Value: 2021-12-05T01:44:38Z
.bleepingcomputer.com/ Name: __gads
Value: ID=464ce9abc714bc84:T=1638668676:S=ALNI_Mb0xIsynV785y5t4k3w3VDILWLnbQ
.mfadsrvr.com/ Name: tuuid
Value: 445d1fc1-46d4-494d-842f-cfe15cd6e197
.mfadsrvr.com/ Name: c
Value: 1638668678
.mfadsrvr.com/ Name: tuuid_lu
Value: 1638668678
.mfadsrvr.com/ Name: bsw_uid
Value: e844459d-39b0-402c-bf5a-7640e7a8c718
.id5-sync.com/ Name: 3pi
Value:
.lijit.com/ Name: ljt_reader
Value: 37e1e7f6223a458ed25ab69d
.yieldmo.com/ Name: yieldmo_id
Value: g67686cd09a053cd6899%7C1638668678859%7C0%7C
.sharethrough.com/ Name: stx_user_id
Value: 99fee750-0d85-4cdf-8744-4e5ad497d21e
.3lift.com/ Name: tluid
Value: 5223479661490903678
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-e844459d-39b0-402c-bf5a-7640e7a8c718
.lijit.com/ Name: ljtrtbexp
Value: eJyrVrIwVrIyNDO2tDC3MDK30FGyMEHjm6HxzVH5lgbI%2FFoAqrUQww%3D%3D
.id5-sync.com/ Name: id5
Value: 984c4285-728d-3786-80ef-78f4a5c31859#1638668669891#2
.id5-sync.com/ Name: cf
Value:
.id5-sync.com/ Name: cip
Value:
.id5-sync.com/ Name: cnac
Value:
.id5-sync.com/ Name: car
Value:
.id5-sync.com/ Name: gdpr
Value:
.id5-sync.com/ Name: callback
Value:
.advertising.com/ Name: APID
Value: VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
.adaptv.advertising.com/ Name: adaptv_unique_user_cookie
Value: "8683085494269228884__TIME__2021-12-04+17%3A44%3A38"
.smartadserver.com/ Name: pid
Value: 8861207277885483119
.sitescout.com/ Name: _ssuma
Value: eyI0NSI6MTYzODY2ODY3Nzg3NSwiMjQiOjE2Mzg2Njg2Nzk0MjUsIjQiOjE2Mzg2Njg2Nzk0MjUsIjM5IjoxNjM4NjY4Njc5NDI1fQ
.contextweb.com/ Name: V
Value: 355Kb29h0Wqs
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1auk|7TZ.0.1
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 837aaaf6c86ab3fb
.creativecdn.com/ Name: u
Value: nxh61y00tA73Nuy4zCQ9
.creativecdn.com/ Name: ts
Value: 1638668679
.postrelease.com/ Name: status
Value: 1
.postrelease.com/ Name: ver
Value: 1
.ads.yieldmo.com/ Name: ptrt
Value: 7de5ca57-c954-4db1-bc90-ae26323dfac5
.ads.yieldmo.com/ Name: ptrstk
Value: fjjYmhumTpxKx2Vf1I9_oCV4zbY
.exelator.com/ Name: EE
Value: "8153d0fd15b3009f912b5b0cb1926e00"
.ads.yieldmo.com/ Name: ptrpp
Value: 355Kb29h0Wqs
.bttrack.com/ Name: GLOBALID
Value: 2uKlc8-sIBd987FnJwC8GOP6eXUEX1V5CHU45XG1JUMIQUVpcIm71vzM5GDQm4woJmr2Sf9hqpQC4TM1
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQcHC0NQ4xSAtxdA0ydjAwDLN0tAoyTTJIDnJ0NLILNXAYHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq0yNJsSX5RZvoiZ8fFRSlpDItKik8F7zuiBABVuSmU"
.lijit.com/ Name: _ljtrtb_90
Value: c0b28e8e-dbbe-4d07-b7cb-3b1d688f17fb
.lijit.com/ Name: _ljtrtb_87
Value: 445d1fc1-46d4-494d-842f-cfe15cd6e197
.lijit.com/ Name: _ljtrtb_84
Value: c:260803f49fc670d26b7a8c97ae1c7d30
.lijit.com/ Name: _ljtrtb_86
Value: nxh61y00tA73Nuy4zCQ9
.ads.yieldmo.com/ Name: ptrbsw
Value: e844459d-39b0-402c-bf5a-7640e7a8c718
.tapad.com/ Name: TapAd_TS
Value: 1638668680853
.tapad.com/ Name: TapAd_DID
Value: a507803e-3812-41e4-80b2-78e5739cd1db
.krxd.net/ Name: _kuid_
Value: OhYp_D7F
.lijit.com/ Name: ljtrtb
Value: eJwVyjEOwjAMAMC%2FZMaS3bi20w2xI%2FGE2k7ExAQSBfF32vnuWxqWpQT6ZN06pHsHTlRwDYfqlGI2SIeXUzE%2B7jIJGtbBbYQo5iSuq0XTtVNoVjym7PPxvgttiM%2Bz1utr48%2Fl1g7T3ZjnpBEELMnAjROMpwExOs2R0qlp%2Bf0BBuwptA%3D%3D
.lijit.com/ Name: _ljtrtb_83
Value: KWSL0RE8-3-ILJG
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2C'!ks6In!]tbPl1M>e)ZlrFUfJ+tGXxo@8dQV:VZF@m=B8rHT$JyQ>uM!7ao8LD'HCUo%nugO%v4VB%nn8c*#-)c
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.mookie1.com/ Name: id
Value: 10597814350218064749
.mookie1.com/ Name: mdata
Value: 1|10597814350218064749|1638668681338
.mookie1.com/ Name: ov
Value: d084bf4378801ff71ad412733651e4a5
.doubleclick.net/ Name: DSID
Value: NO_DATA
.mookie1.com/ Name: syncdata_TAP
Value: 1
.eyeota.net/ Name: SERVERID
Value: 18064~DM
global.ib-ibi.com/ Name: ASP.NET_SessionId
Value: lkitb2smltmwgp40pmwuh35k
.adingo.jp/ Name: ID
Value: 0e2b95cc6d058db40d4b741338e74ed5
.addthis.com/ Name: na_tc
Value: Y
.dlx.addthis.com/ Name: na_rn
Value: 0
.dlx.addthis.com/ Name: na_sr
Value: 20211205
.dlx.addthis.com/ Name: na_srp
Value: 3614
.dlx.addthis.com/ Name: na_sc_e
Value: 0
ib.mookie1.com/ Name: ASP.NET_SessionId
Value: foavxpi2tmpsaelsqeraocuo
.ib.mookie1.com/ Name: ibkukiuno
Value: s=c08b318c-67a3-445b-932d-fa16c7f6e5ea&h=&v=0&l=-8585629382025087429&op=&hl=0&vlu=0&tcs=1&dcc=-8585629382025087429
.ib.mookie1.com/ Name: ibkukinet
Value: 628673974=-8585629382025087429
.openx.net/ Name: pd
Value: v2|1638668683|vMbwgag2gKvPhEkWgyiK
.33across.com/ Name: 33x_ps
Value: u%3D118820789922446%3As1%3D1638668683742%3Ats%3D1638668683742
.media.net/ Name: visitor-id
Value: 2816702837397404000V10
.tynt.com/ Name: uid
Value: wLCIO2GsGYvUewDbHSepgQ==
.tynt.com/ Name: pids
Value: %5B%7B%22p%22%3A%227daaa56bb0%22%2C%22f%22%3A1%2C%22ts%22%3A1638668683884%7D%2C%7B%22p%22%3A%2224c05c7b76%22%2C%22f%22%3A1%2C%22ts%22%3A1638668683884%7D%2C%7B%22p%22%3A%22bac1bc34e2%22%2C%22f%22%3A1%2C%22ts%22%3A1638668683884%7D%2C%7B%22p%22%3A%22d26852f088%22%2C%22f%22%3A1%2C%22ts%22%3A1638668683884%7D%2C%7B%22p%22%3A%2222833ea406%22%2C%22f%22%3A1%2C%22ts%22%3A1638668683884%7D%2C%7B%22p%22%3A%22f9a4a8fd15%22%2C%22f%22%3A1%2C%22ts%22%3A1638668683884%7D%5D
.yahoo.com/ Name: APID
Value: VAe7a68cb6-556c-11ec-b278-0eab3dc42d74
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSsjS3NDYytDAyNDU1MjM1NDI2EuIz1HXOzMkq8_MqDM01ypLiNTQztjAzszCzMDEwMgEACPp9PTMAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSsjS3NDYytDAyNDU1MjM1NDI2EuIz1HXOzMkq8_MqDM01ygIAl7A2_SQAAAA
.pubmatic.com/ Name: DPSync3
Value: 1638748800%3A174%7C1639872000%3A197_201_219_221_228_236%7C1639267200%3A164
.pubmatic.com/ Name: SyncRTB3
Value: 1641254400%3A224%7C1639267200%3A2_15_223_38%7C1643846400%3A69%7C1639526400%3A63%7C1639094400%3A216%7C1639958400%3A35%7C1639872000%3A55_176_8_54_57_165_21_238_189_99_13_56_3_231_5_7_234_81_96_222_204_239_233_178_71_104_22_220_166_240_48
.casalemedia.com/ Name: CMST
Value: YawZhGGsGYwA
.c.bing.com/ Name: MR
Value: 0
.bing.com/ Name: MUID
Value: 11864E779CB56B4C3CE95F739DCD6AC3
.w55c.net/ Name: matchmedianet
Value: 5
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: lidc
Value: "b=VGST00:s=V:r=V:a=V:p=V:g=2581:u=1:x=1:i=1638668684:t=1638755084:v=2:sig=AQG4Q7qQ36U1Lpiarhx3NMbpo0ilorM3"
.linkedin.com/ Name: li_sugr
Value: c470db56-01bf-493f-970b-464e03c90b90
.linkedin.com/ Name: bcookie
Value: "v=2&6ec30b77-bcfb-426d-8fbc-ea826a84146f"
.rlcdn.com/ Name: rlas3
Value: ca12gxrRY7ozP9Umq6B+UYSDVaJEB1rynqgGbdBpkjI=
.mfadsrvr.com/ Name: ssh
Value: !medianet,1638668684!sovrn,1638668679!bidswitch,1638668678
.media.net/ Name: data-rk
Value: 979321821552651232~~8
.rlcdn.com/ Name: pxrc
Value: CIWzsI0GEgUI6AcQABIFCOhHEAASBgi66gEQBw==
.openx.net/ Name: univ_id
Value: 537072971|7de5ca57-c954-4db1-bc90-ae26323dfac5|1638668684241780
.dotomi.com/ Name: DotomiTest
Value: 21ae8a656132122e
.zemanta.com/ Name: zuid
Value: trvwnD5JptIAO-iXxRvu
.media.net/ Name: data-xu
Value: IoqlAHf41MTGzX5~~8
.media.net/ Name: data-ttd
Value: 7de5ca57-c954-4db1-bc90-ae26323dfac5~~1
.media.net/ Name: data-mm
Value: badc61ac-1985-4000-9788-0d2b1d82255b~~8
.media.net/ Name: data-g
Value: CAESEK-ZOrDvhWq6J9C3ATpVbTg~~8
.admixer.net/ Name: am-uid
Value: 6a9099fe149943558409bf11cf581e18
.yahoo.com/ Name: APIDTS
Value: 1638668684
.media.net/ Name: data-amb
Value: 7864110075816986117~~8
.media.net/ Name: data-mf
Value: 445d1fc1-46d4-494d-842f-cfe15cd6e197~~1
.criteo.com/ Name: uid
Value: 590dcce8-2386-42d6-b790-0496b3dda96c
.taboola.com/ Name: t_gid
Value: c37cf53a-b31d-44ca-8259-d06cf5f5798d-tuct8a59f0c
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAFvFwmtoZmxhZmZhZmFiYGTSJIjENzExBADesWxKIAAAAA
ads.playground.xyz/ Name: connect.sid
Value: s%3A-IsB5gtVo42-CFCy2QEj76zUMj88JQ8N.ZBmbVbjYRJKiDRBnDr2Zrlqnaa36QzEwt%2BcmVUAxTNU
.fiftyt.com/ Name: fifid
Value: d4bbf2ea-4de6-4295-4f63-e34e917e489c
.fiftyt.com/ Name: cs
Value: MTYzODY2ODY4NHxEdi1CQkFFQ180SUFBUkFCRUFBQUJQLUNBQUE9fGGBKPIQDt8KUaXjw0kACRNbr7_yS34amAtuunSYBCH_
.adsymptotic.com/ Name: U
Value: e8cc3384036825b3d0d76f98b28a130a
io.narrative.io/ Name: io.narrative.guid.v2
Value: ebedc561-556c-11ec-8734-065a0b8073db
.media.net/ Name: data-co
Value: AAAGdc-Aay3uBQN1cTHvAAAAAAA~~8
.pubmatic.com/ Name: KRTBCOOKIE_1278
Value: 23329-a5677e3a-ded4-44c9-b5be-254f6a67d483
.media.net/ Name: data-c-ts
Value: 1638668684
beacon.lynx.cognitivlabs.com/ Name: UID
Value: e862cc5f-ec80-42ac-b559-d0d565b0a9d3
beacon.lynx.cognitivlabs.com/ Name: ss
Value: qd%2F6NZIWj0M82gFgKU2hnYLje%2BREmKK%2FNnQgYb8fzNTRsuDaVjdGtzwaJRUHo9j4DJmRTSjKYmig3vR93ITBEw%3D%3D
.media.net/ Name: data-c
Value: 590dcce8-2386-42d6-b790-0496b3dda96c~~1
.eqads.com/ Name: EQUser
Value: UID=6fb51e2f-a118-4c64-a2e3-9b08e033535b
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-4764934967218434204&KRTB&23263-4764934967218434204
.agkn.com/ Name: ab
Value: 0001%3A%2FUllfcsLttaXP7BomYfpKsLd0sVTFXgc
.adsrvr.org/ Name: TDCPM
Value: CAESFwoIcHVibWF0aWMSCwielYvB2uabOhAFEhsKDHNoYXJldGhyb3VnaBILCPqk4tva5ps6EAUSGAoJbW9va2llLXBzEgsIrq_c49rmmzoQBRITCgRrcnV4EgsI0tC879rmmzoQBRIWCgdzdng5dDUwEgsIvJO7gtvmmzoQBRIUCgVvcGVueBILCKD4_YLb5ps6EAUSGAoJYmlkc3dpdGNoEgsI8rPmh9vmmzoQBRgBIAEoAjILCPKr6bTx5ps6EAU4AVoJYmlkc3dpdGNoYAI.
.fiftyt.com/ Name: fppm
Value: 20211205014444
.tribalfusion.com/ Name: ANON_ID
Value: aLnu7qpkijdDifqAaEc7V4VZbjemwMw7J1YqW3E6TgmZcd7xPPUKiRaFZaNmLSlCZdDZbw3ZcH82ZbH6ymXIVZaS0kfhvQ103fUu8PPtY5WTkRZbR
.mookie1.com/ Name: syncdata_IOW
Value: 1
.onaudience.com/ Name: cookie
Value: 27ef478db6b78c1a
.onaudience.com/ Name: done_redirects219
Value: 1
.adsby.bidtheatre.com/ Name: __kuid
Value: 1dac68b7-b69a-4192-845a-8b17d560cf53.407882684
.quantserve.com/ Name: d
Value: EHUBFQHxJIEO-TD9r7EA
.analytics.yahoo.com/ Name: IDSYNC
Value: "18z8~21wp:1769~21wp:1776~21wp:190u~21wp:187s~21wp:175w~21wp:18ym~21wp"
.media.net/ Name: data-ze
Value: trvwnD5JptIAO-iXxRvu~~8
.zeotap.com/ Name: zc
Value: 520b764d-9055-4078-6f4a-c901c72165e5
.zeotap.com/ Name: zsc
Value: %E1%C9%00%3B%18%3F%84%E0%E0%EF%F4%BF%A8v%90%1D%F9%25%9B%F0%A8%DA%D6%9B%DE%7B1%17%1C%10%CF%CFF%9FT6%12%10%84cZ.%1F6%C8Z%B2V%29%BD%A0%7B%F3%06%F0%B5%81sg%F1%D8%DD%28%A2%CF%14wto%90%27%01%A5X%DF%1B%B7k%E1m%3EMs
.adaptv.advertising.com/ Name: migrated2y
Value: "1"
.rubiconproject.com/ Name: audit
Value: 1|clb2f5t+FPqM00xP7nVaZ1MG4C6D/t+3W6FWnAiXnYBIRDOR5xDjbWXsA7EjqCg6xPaSE/X/imYfBYRBeRcCfxh/6qRlWSa6aNgdOVL2Yy+ZLSzkyHji57KpUjWTmmg0
.media.net/ Name: data-bs
Value: e844459d-39b0-402c-bf5a-7640e7a8c718~~1
.casalemedia.com/ Name: CMRUM3
Value: 6f61ac198c27604764934967218434204&2861ac198c27606fb51e2f-a118-4c64-a2e3-9b08e033535b&4061ac19892760d92c1335-ca50-4f90-833a-a227baf8a315-61ac1985-4341&e661ac19862760&0561ac198605a00&5861ac198c05a0&ce61ac198c05a0&2761ac198727607de5ca57-c954-4db1-bc90-ae26323dfac5&4961ac198c05a0&c461ac198c05a0&9861ac198c05a0&0361ac198c05a0&f161ac198605a0&8261ac1986a8c0&8361ac198c276018072662301220038102&2e61ac198c27608987304192775495297&2d61ac19892760CAESEHi02zuspfbSpmDs0x1dCh4
.c.appier.net/ Name: _auid
Value: sSE8PgZVA8-yk7I4jRmsYQ
.pubmatic.com/ Name: KRTBCOOKIE_904
Value: 16787-sSE8PgZVA8-yk7I4jRmsYQ&KRTB&23130-sSE8PgZVA8-yk7I4jRmsYQ
.pubmatic.com/ Name: PugT
Value: 1638663604
.mookie1.com/ Name: syncdata_NEU
Value: 1
.districtm.io/ Name: _dm_uid
Value: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAwLCJ1c3IiOiJxZ2FDQXJJR0d6SXhjVlpqWkdWemRUVkxUSE53Vm5Ga1YwSmxPWGRaY1daMk43b0dLUWlaVGhJa1pUZzBORFExT1dRdE16bGlNQzAwTURKakxXSm1OV0V0TnpZME1HVTNZVGhqTnpFNHVnWWdDS3BPRWh0bWFtcFpiV2gxYlZSd2VFdDRNbFptTVVrNVgyOURWalI2WWxtNkJoa0lxMDRTRkc1NGFEWXhlVEF3ZEVFM00wNTFlVFI2UTFFNXVnWURDSzVPdWdZRENMQk91Z1pRQ01OT0VrdDVMVWhKY0dSR1IwWkZNblZGVkRaUmNEazRlWHBzYUdsalFXMXJkMWt1VWpZdWZrRitWa0ZsTjJFMk9HTmlOaTAxTlRaakxURXhaV010WWpJM09DMHdaV0ZpTTJSak5ESmtOelM2QmhjSXlFNFNFamszT1RNeU1UZ3lNVFUxTWpZMU1USXpNZz09IiwiaWF0IjoxNjM4NjY4Njg1fQ.phe0gEifeO4CGOQ-lN527RrduJqlTafuVr27rhEFHZvTFfD62bs6Vm9ql3BtuzuCAePxKzlJy71ggyd-Egg6Ig
.v.ssp.yahoo.com/ Name: adaptv_unique_user_cookie
Value: "8683085494269228884__TIME__2021-12-04+17%3A44%3A45"
.pubmatic.com/ Name: SPugT
Value: 1638668686
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 3
.pubmatic.com/ Name: pi
Value: 156696:4
.ads.pubmatic.com/ Name: pubsyncexp
Value: 1638690287078

12 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network error URL: https://id5-sync.com/i/882/8.gif?id5id=ID5*FIAfvhFjd4g_s60lEMFSGxJ_KGodchv-GGaTFxB6ckAA5QHxpDu04XRDy1_qhK6jAOhbuDZa_jqAQYm3me02SQDpjo3p-l9G1m7nQ5NJ8FQA6q9pz4jYfBYJ43l3TUGMAOtc8CkCulq7A9b3BXqTPQDtRyiIKmN99eqh_EOAAOIA91t72dytSY_SCB36povLAPl8L3bQMHL1gfEfZhpDOQD7Kfi1QqyinOk61gYyYmQA_o7njAua1RiCswmZkpPUAQGxgSHwyiVMi17ZCipt6wEEeYBcjBH-XGY5KC2ePNIBCN33d7Ml2xXxJxnz1n6aAQsd41-re8tOd560CPRs7gEOWDAVDxI0f7WQG1YB9KIBEcv0gdd0rFMMy7yyU3IUARTh9VGIZwteuk8oNHYYewFCa86aBHbmODmLCT3V_gIBRJIMfAOvIMONTYb8Xa9-AUefQqQQzq5PwibDYfHDjgFOTpehPv7DwXod5DfA-0gBUZzRz4ZG6SrNpvLCnjKn&o=api&gdpr_consent=undefined&gdpr=0
Message:
Failed to load resource: the server responded with a status of 403 ()
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network error URL: https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=8987304192775495297&pn_id=an
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YawZhBbaf_sLobsSgmffIQAAAEsAAAIB&google_cver=1&google_gid=CAESEOVneTnz3NNbA690O78Xu9g&google_push=AYg5qPJp9RmufW993ZabQQ34H5lfiSjFuMzhjdru_eamz71cs2lXxcdW7LqaSoJBYwW9gfQKOvKfyT3uEdEQV0qENwl0PsSucX0u
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPKCHw3pZBNq9ULyONuQ1Mzxhg5n4hdUTNFcmM1RQWznrPXr5EQ65PSFhUTRLXVJRwAns30_vxEHEA8XSPSjEw2GyebJ8jo&google_hm=0e2b95cc6d058db40d4b741338e74ed5
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
security error URL: https://cdn.districtm.io/ids/index.html
Message:
Refused to execute script from 'https://x.bidswitch.net/sync?dsp_id=419&user_id=10597814350218064749&ssp=%3CSSP_VALUE%3E&gdpr=&gdpr_consent=' because its MIME type ('image/gif') is not executable.
deprecation warning
Message:
'window.webkitStorageInfo' is deprecated. Please use 'navigator.webkitTemporaryStorage' or 'navigator.webkitPersistentStorage' instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

33across-match.dotomi.com
83e66e08a2fbcdcad090c0453f5246b2.safeframe.googlesyndication.com
a.pub.network
a.tribalfusion.com
aa.agkn.com
abs-0.twimg.com
acdn.adnxs.com
acds.prod.vidible.tv
ad-delivery.net
ad.doubleclick.net
ad.turn.com
ad4m.at
ads-ec.v.ssp.yahoo.com
ads.adaptv.advertising.com
ads.playground.xyz
ads.pubmatic.com
ads.yahoo.com
ads.yieldmo.com
adservice.google.ca
adservice.google.com
amazon-tam-match.dotomi.com
aorta.clickagy.com
ap.lijit.com
api-public.addthis.com
api.btloader.com
api.floors.dev
b1sync.zemanta.com
bc-ssb-cle.springserve.com
beacon.krxd.net
beacon.lynx.cognitivlabs.com
bh.contextweb.com
biddr.brealtime.com
btloader.com
btlr.sharethrough.com
bttrack.com
c.amazon-adsystem.com
c.bing.com
c.pub.network
c1.adform.net
c21lg-d.media.net
c2shb.ssp.yahoo.com
capi.connatix.com
cd.connatix.com
cdn-ssl.vidible.tv
cdn.adnxs.com
cdn.districtm.io
cdn.firstimpression.io
cdn.id5-sync.com
cdn.krxd.net
cdn.syndication.twimg.com
cds.connatix.com
ce.lijit.com
choices.trustarc.com
choices.truste.com
ck.connatix.com
cks.connatix.com
cm.adgrx.com
cm.g.doubleclick.net
cms-xch-chicago.33across.com
cms-xch.33across.com
cms.quantserve.com
consumer.krxd.net
contextual.media.net
core.iprom.net
creativecdn.com
cs.media.net
csync.loopme.me
d.pub.network
de.tynt.com
dggaenaawxe8z.cloudfront.net
dis.criteo.com
dmx.districtm.io
dsum-sec.casalemedia.com
dt.adsafeprotected.com
e.dlx.addthis.com
eb2.3lift.com
ecdn.analysis.fi
ecdn.firstimpression.io
eus.rubiconproject.com
fastlane.rubiconproject.com
fei.pro-market.net
fonts.googleapis.com
fonts.gstatic.com
freestar-d.openx.net
freestar-io.videoplayerhub.com
freestar-tagan.adlightning.com
fw.adsafeprotected.com
geo.moatads.com
global.ib-ibi.com
gocm.c.appier.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
grid.bidswitch.net
gu.dyntrk.com
gum.criteo.com
hb.emxdgt.com
hbopenbid.pubmatic.com
hbx.media.net
htlb.casalemedia.com
ib.adnxs.com
ib.mookie1.com
id.rlcdn.com
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
imasdk.googleapis.com
img.connatix.com
insight.adsrvr.org
inv-nets.admixer.net
io.narrative.io
jadserve.postrelease.com
js-sec.indexww.com
loadm.exelator.com
m.addthis.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.bnmla.com
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
match.taboola.com
mb.moatads.com
medianet-match.dotomi.com
mweb.ck.inmobi.com
mwzeom.zeotap.com
ny1-bid.adsrvr.org
nym1-ib.adnxs.com
odr.mookie1.com
p.adsymptotic.com
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
pbs.twimg.com
pghub.io
pippio.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.advertising.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
platform.twitter.com
pm.w55c.net
pmp.mxptint.net
pr-bh.ybp.yahoo.com
prebid.media.net
ps.eyeota.net
pubmatic-match.dotomi.com
px.ads.linkedin.com
px.moatads.com
px.owneriq.net
rtb.adentifi.com
rtb.gumgum.com
rtb.mfadsrvr.com
rtb.openx.net
rules.quantcount.com
s.amazon-adsystem.com
s.ntv.io
s.tribalfusion.com
s0.2mdn.net
s7.addthis.com
s9.addthis.com
sb.scorecardresearch.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.cdn.fastclick.net
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
spl.zeotap.com
ssbsync-us.smartadserver.com
ssc-cms.33across.com
ssc.33across.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
stags.bluekai.com
static.adsafeprotected.com
static.cloudflareinsights.com
storage.googleapis.com
sync-amz.ads.yieldmo.com
sync-pp.ads.yieldmo.com
sync-tm.everesttech.net
sync.1rx.io
sync.extend.tv
sync.inmobi.com
sync.ipredictive.com
sync.mathtag.com
sync.resetdigital.co
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.technoratimedia.com
syndication.twitter.com
tag.idsync.analytics.yahoo.com
tag.sp.advertising.com
tagan.adlightning.com
tags.rd.linksynergy.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
trc.taboola.com
trk.vidible.tv
uat5-a.investingchannel.com
um.simpli.fi
um2.eqads.com
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
us.creativecdn.com
usermatch.krxd.net
v1.addthisedge.com
vid-io-cle.springserve.com
vid.connatix.com
vid.springserve.com
visitor.fiftyt.com
vpaid.springserve.com
widget.us.criteo.com
widgets.outbrain.com
ws.rqtrk.eu
www.bleepingcomputer.com
www.bleepstatic.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.reddit.com
x.bidswitch.net
z.moatads.com
cm.g.doubleclick.net
s7.addthis.com
trk.vidible.tv
104.126.112.185
104.126.114.7
104.16.190.66
104.17.119.107
104.18.101.194
104.20.60.209
104.244.42.8
104.244.43.131
104.26.13.6
104.36.115.109
104.36.115.111
104.36.115.113
104.36.115.114
104.45.178.220
104.64.223.161
107.178.246.49
107.178.254.65
107.21.96.249
129.159.70.95
13.225.205.179
13.225.214.111
13.225.214.85
13.225.63.107
13.226.37.103
13.226.37.126
130.211.23.194
142.250.65.194
142.250.80.66
142.250.81.230
142.251.41.2
147.135.11.205
15.197.193.217
151.101.1.108
151.101.1.140
151.101.129.44
151.101.130.137
151.101.194.137
151.101.194.49
151.101.2.133
151.101.248.159
151.101.66.133
152.195.14.41
152.195.32.163
156.154.202.36
159.65.197.210
172.105.203.31
173.231.178.82
178.250.0.163
18.189.161.24
18.195.106.43
18.207.77.150
18.209.200.15
18.215.212.25
184.29.132.233
185.167.164.39
185.184.10.30
185.184.8.65
192.132.33.46
195.5.165.20
198.148.27.139
199.127.204.147
199.187.193.179
199.250.161.129
199.38.167.128
20.72.149.136
2001:438:65:11::1720
2001:4998:14:800::1001
204.62.13.72
207.198.113.177
209.54.176.128
213.19.162.90
23.199.204.79
23.208.216.126
23.211.130.59
23.5.238.78
23.52.160.130
23.52.161.180
23.52.162.163
23.52.162.190
23.52.162.21
23.52.163.40
23.52.167.93
23.73.244.44
23.88.75.187
2600:1901:0:8eee::
2600:1f18:4e9:5a07:6be:e2b0:f1c0:b548
2600:9000:21dd:9400:15:6f6c:b180:93a1
2600:9000:21dd:9a00:6:44e3:f8c0:93a1
2600:9000:21dd:be00:8:48e:53c0:93a1
2602:803:c002:200::62
2606:2800:220:1410:489:141e:20bb:12f6
2606:2800:220:de:468:2285:c1:4a3
2606:4700:10::6816:1857
2606:4700:20::681a:18b
2606:4700:20::681a:78b
2606:4700:20::681a:ad1
2606:4700:20::ac43:4513
2606:4700:3039::6815:c077
2606:4700::6810:5e41
2606:4700::6812:c05
2606:ae80:1451:13::2360
2607:f8b0:4006:807::2002
2607:f8b0:4006:807::200e
2607:f8b0:4006:80a::2004
2607:f8b0:4006:80a::2006
2607:f8b0:4006:80a::2010
2607:f8b0:4006:80b::2001
2607:f8b0:4006:80b::2002
2607:f8b0:4006:80b::2003
2607:f8b0:4006:80c::2001
2607:f8b0:4006:80f::2002
2607:f8b0:4006:81e::2002
2607:f8b0:4006:81e::200a
2607:f8b0:4006:822::2008
2607:f8b0:4006:822::200a
2607:f8b0:4006:823::2002
2607:f8b0:4006:823::2003
2620:100:a001::c
2620:109:c002::6cae:a0e
2620:112:f002:bbbb::21
2620:116:800b:21:61c0:eb61:c438:2f4e
2620:1ec:c11::200
2a04:4e42::300
3.13.244.143
3.134.2.65
3.142.30.148
3.19.190.206
3.223.207.71
3.223.214.70
3.228.229.208
3.230.217.116
3.233.68.37
34.102.253.54
34.107.148.139
34.117.239.71
34.149.20.76
34.198.192.195
34.203.25.60
34.206.47.24
34.233.74.164
34.98.64.218
34.98.67.3
35.169.74.7
35.190.60.146
35.190.90.30
35.201.71.192
35.201.96.126
35.207.24.140
35.211.165.199
35.227.238.208
35.227.252.103
35.241.45.217
35.71.139.29
38.27.122.101
38.67.14.233
38.91.45.7
45.35.192.162
46.105.202.126
51.195.5.234
51.210.112.63
51.81.106.33
52.0.156.250
52.1.108.21
52.116.221.248
52.20.92.17
52.202.147.57
52.202.47.217
52.3.145.60
52.4.60.129
52.45.80.111
52.5.82.14
54.146.21.104
54.161.144.238
54.175.87.114
54.192.160.42
54.208.142.27
54.209.16.83
54.230.162.118
54.230.162.32
54.236.220.178
54.82.161.49
54.83.242.41
54.86.74.19
63.251.114.136
63.251.86.49
64.58.232.176
64.58.232.180
64.74.236.127
67.202.105.24
67.202.105.32
68.67.161.183
68.67.161.206
69.173.151.100
69.90.254.78
74.119.119.150
74.121.140.14
75.101.253.183
8.28.7.84
01c03b8eb0f7f27dd5ec8e28f4fe83079c56521e05b05e5099675154c7f10458
03b0b4ea7bd75f32536e7c0cad82a35dacd449b1f626ef7ffe06591b210363de
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05e21e597d8b39daf0423ada3660186627b4414356218094a904ded553cec780
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06ecc1573d3bd555fe29b67a1f5f9a4f560413c5d3a979eb7ad1960866ddbad8
0769d8125b946cad18ce6466837731e9333ef912462e0dc28a640f3a67c0b0ce
080d3929d4c6f0ca45ddef3f56e45b6372b9b00b03ade7fc36c959f94ef8baff
08317f599d67cf552a32fc308e2dd500f03ea0ff9c3fc3e7a7dc0d7c9047d375
08f07fe6ccc95f5355c2d99f8ffa854aa6911710125cdc26d3cbd8b48568ede5
09343d3b3473e1c994b2d603c99feb8a0f63fbd3ff20be7432ff18b973dbe651
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
0962348d31ed6b62de54fea45aad46976756dd82ffa406385a8fb30b65cccdb6
0aaac8249462a27d0feb5a870d78db4889a4064214f9baee2ef8b4be19bb16a6
0b37f3d8aa5e1f298bf71477c945f576745020ce44f048ec67e19a93cd285372
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c0248c11ea32b5473ed1e5e23797342cb05f360f3078eab3231fae6f550e036
0cdce68d55ff0acea805c6354fafdddf6cafc1b111a9ece1f891acf3e5a5dc6d
0e61d9c07f949b822eb61a32c30fe7daaac55426d4f1b88e55da0782aa3ce75e
0e8670554443313b972c10ae1a34baeb408d060fc5e82c6a358f77d7e98dd15e
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f35719d73ced9e0bc4385a027050b3ecf4fe24b70fe1e7b6337422e342e633a
0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f
0f43d6dfd24b62e95baf46356acc669f8a0d75f10daea9778d1798410b84dd62
0f9c6e99f4a6f8609f7ea272ad3b19aabd6cdc50779cea5806a04ae7fa22eb11
0fbc13828b69cb6d7602d41ad5469f89cae9c180674bac46caca957992d09899
1185224870c6f5694bb53b88a691075e94a419665ca626df7e026e620f561566
1263cf1317b60eb2243d9d60b2772b31f665732c3c92553f1403be5f7858b267
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13dc2a27361e4dd4af160a4adfb7b8185e6975c65702bc477587607533c9712e
140852976f26386afd24e8b07c5fd1c4f43c4bf004236d3bd3a704ee154e99f9
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
16b76921dd3277b08abb6df1637115bab33293b31db9547459b8e5bb9f515ed6
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019
1bf67ddd4ac63675d2dd65b5a3e619a158ce5defdca73301641a8db052b8e4f4
1bfc2c2ee9af9b35c72c475c8c25d1004f5b43e34b2da6bfd4d99798afe12c9d
1c2529c4a862e2aeb90919c7185507f674d87b517c404964d4ce831e13bca0dd
1d0b406d9f024c1101f5cb159e169fa0a803b595673c72acf165656c94f35393
1d48b14f1d9577dfdf1319c531f0383320d168b35caccec7e98322264eebfbb1
1d71682fbb31fc64ba19097a9eb389593ba1bf9f9f913bef6eaf563eb08c2a7a
1da31085512b343f2de6f64bcdbeeb3bc50a54859a5fb7878c434fde47510405
1fbd3c6688d8fa927d73b2b6732d7dc1285972b6d6d4684fe811a3284f7b5a58
21762c5709391da7dbe652cf5703cfadac9180820048e4494fb2973fb7ddbfe5
222e34a90789c24c76384279358846781b332116af4bc26e5c04439a44c55250
2247a33d9ec387271839485ea86a7526c01242242c2aec936ed7d62ce792447d
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
229fbe11830e86deb5bb19aa918b137968fa86f060f78d88cd67c501a4552b3d
22e1299474bc27ea501a2ea192fc8de44a72d6be7947c75dd08aedbba683c91b
22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285
2383416635c3508794c060f27958892f5d093d8c58c9484f968fd4e1d0c27857
23bcba5e39f4c422df7d14309b7435de0a2251ff20ca1a415b95e1d34343b2dd
25d600a009c1aff75bc9f7a09634c9d0521f426dfb9a5543fbbe58bcee474bef
263b5c14ea0c8dba145eaa30a0e60b7f9e0d3cb3c8f2356f59832ff329fa6d38
2816082c025f64540b613fde3096d814ae21ac75279461ec1d6bcb5c07099fdd
28253cd6734e65790bf90144f11a41c620c76d36437af4bce727566e1ac59dc7
28a3ec1793ece736d1bbd95c5f8e457f47e0a5473339a6ffa0d45e875f5bc5d7
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2af10b9c9dd4d6b4239687a27938947a38179a67c80498d29069b23ee95d0c16
2b2d2472f310f3a4c880947f473b8de3e58662291206e24a5426ee2bd64684ca
2b4d031954748e7f374abdfec4a7c1e2f83f7fadf0542058010250c0024970d1
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2d74ea00c0e8d18b22d73aa5ec7a393f1c14490f5a202f59c7ab7d0be7044e23
2da05d5c1e5b6415b70de890846fcd373dab2151747976fa9776fc9f89af97e0
2db2d5706df1eb1a898a5de4b166bffc91c0d63f7bb1dba37c663b6fd112a6e4
2e774ee383518a9662cd4215456c8e96bf45cfb05bd2ab57a390191aa1f86ae9
31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
3397516373d30834077a14b7b0d87c05c1b23dd270c331aa5a376dff4b987348
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590
3400bc6028f6d330d201f515f120247f9f825186ccc98d48fbf035a0f874c184
341cd09c496e0174d4337fa85c8861bf3844ec1b9298ac902ca4a03f10af9730
3542a358999ee2612135951c3e43e1ee9d928c8fdd9cc4f05cdea754e1c8bd4a
3645c15aa6e70a1557f8d3520402e0cfc620251a090adda789de9e3e7ea6c551
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d
3b2264196284aad7b0d1f1fea4a65609d8d460cc0d18de705d5e6cba14d588d1
3b7c7d6643053e78c799bbf5dbadb05e66477a788da19dba5789bb2e46f1ee71
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9
3c0e96bd82e30f54f74b90774f36d30a7d7224671644263dc4cb393d2b3a25e3
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d
3caa5b1c27ad830f58eac251b063696fca3040c81237a46ea293836d1779ef90
3d48b44f1a81248c7fa11ec634852c317f855f3505442e41d8bfced0f0db0e94
3d510e16e6e569e573980fd67a55221795d539fd56688ecaca8d284255e86ee6
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3dd0cfa8ac83f0a57908bb74e7cf30a7e6209bc2dfcc20a5e2dc7c5d86d16d54
3e6aee43ce232f5c967d532d699c8dd2366873b4a61a6d6cbebb3606174a4a61
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
3fef19e536824cf94f0a91aa3c591c5cce3a2324b0cb39b2a848ec4ea8ff642c
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
41578770d740012d57be1d400db47fdba90631e27363a4877af6cc54a032ad10
41ae990b4b47df05c2c0f3df04d18956fcd62639f47301fab46965026c878247
42050a0fdef878dc249fc51498e5c67146a2f9becbef81c1e5edbe32d85435ca
42b601bc0d93dfca6e350b46d113bf8e7ff9e40a87a0c57ab9b3c9c219062423
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
465b31f84196ddfdd21c859a1460c95d70093d91e3ae5ce5c688c398b9dc20f7
487fce51fd801415c362f3f9f2df43c445a4b9ba38f9b6d49dfc898dc85ede94
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4901b094a91ea6d5aba73774bb9803fdca22599cfca597ef81249225b5ed01b4
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4a73235c1476b3cf7f7eecb637ca2842db3084523a177b51c88f238a54d0f8ae
4a80bb3f691bba6f0b532713f0276cc41362c9d0a70fc651d2ca2e2d7d293647
4ac776207c5b693e5588a6e485f418c892c8aabeaf94cde12ed1ec57d329e32c
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4beda28dcae03d0a09cf69fca1ebf4479111dd8479ac6657815888be6841a194
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a427a86edd270a769be6b028c0513a241e39b623e44774b9fa7ad4aeb6b084
50cc2ba64721a6489beb02e7470f1d753cf0b02c4868f47e5ef8a975ec7fa1d0
514c455980c4b24e717a89a6f230a4841562bd5ffd16d584765735f982333252
5195609afbc1fca03f3200b50d97a90a8eb0e4652108db990a1aa9a1c9f7a0af
51ae4c5642051d85bcfb8ed5d7ce619a0fd7cd201723c823f7495a829eefaa72
538605b11db372d2a91449ee4290c7c782fa348f7264d7e74acc48cdcb2059bf
5403fee0bcc90c867c9ea4e521593432aea7c30ac3b2779ba0ce120be17c931c
5414daf75d510ecc695f41229d2523921da62e596d787693b21f9443d1bd019b
541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
555c76ffcebb70f2c31d10cebc64edba66846cfee5755ce7fd8cf195ea1c4d0b
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5754c7737efcd4a8f067c11d2fb94902c5c956bbad9f157c5d116883af9d252a
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4
59d6a1ad252c9993eeb7899bbf9fe12b0942588987aaf144d0a11f20463f8d98
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a
5beecaeceee4fae5080c40d2ad96dd7c0b7e5a9bc242fbe2b99ab1276aaaae94
5bf0a170ae91f1bb8d0c94381a74ab8b85f938bf31bf18a9c8e3b835250d3be6
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5cbd8dc729043efb7fe66a51d9d5eda549dec7321059f03f3be5665d1e9ea027
5cc24dfcca7634e02dae7d2f3e8a42d09bc14b6365efc28ed26f3a362f19b934
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
60b3ae905684a16f7f063bb999a485205fc471ee90eb74b95f857cdd2ac25a10
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
61240b59a6b32dc70071273d884dbbc0a432a903465be52987c74fd01b61597d
612fceda8faecf8133dac77ef5f4eb30be265cadd946541f796a74efe25cd3c7
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69
655e1b1c2df2d432818e7b88a43034255279b0b75d20a08cbca8ff6ccbf85330
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
662c242e123bfa13a1554f93988a23846fbcd5aa988580427b70999a137a49db
66658c2b2998db7be971185ee18706d3907f15ad4e9d25830fac20130f9b156b
66cc9a6743588321c2f117d4b0fa8d8347f581ca9c50af6a959c7fa23eb5883c
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2
6a9f017be3a24e5b11480d5136da78506f3a6178d1ee6f54931b577fc72ff1ab
6ab7fe4973bf2b22f36a0225e4bdf579916b2178399ef4976e940fb949d9133a
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045
6b3dadacf3fa028c53f78d0b543b15203609955b2bab711a6f659ef8eec1fa3d
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cbf3d5198e3c67803ca9868b5ee9c2c464f2e6ddcce9cef64ed608c5c57949f
6ce5751b03dc9efbe605ad6fbdc4c9e90ebaf600a62859d4b5e4ef3a7c35fd4c
6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144
6f45a889bad84e2aeab39ded79da5aa568bca08dcf1bf573d2b11262b9cf9289
726165c339922323b114b0d17ef447e7306c3c0221dc0a49375d7673a3ecbdfb
741106ff7bb4c2b7d2ddfa50b0cb4b7ca451b0dc0cd4ee93e965d3b537fe1150
755af9e996edb7ac0fb05eeb681a187e51f8b5e9f11fcb3249228c7cfcff99fd
762072bf05605eac7dbd75afd26a52645f467038fa9b8d75620fa942eff0685e
77f28dee1711e11fef9960073fe4da9c9a442931f62711ee7ec7fa22fde30edd
78cf8a7dbbe74dbef3f36a214ad0ce6f50a430b2d18eac029076c2dcd7355d9f
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7abdd47254800f35ffef0fc434fa7fcf432e13651b27670b2e6f8e08143d4b00
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a
7ca703a20171d4d4440daefb529292d7720e3bb2b0aa1aa6d797228bcd3b762c
7ca91b7f677742077ad7bc966c790a156fb2f9a50de5c94ec108e459da932db3
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c
8060b94c7429a7e4c4ba3d5c1f31f25713b673753f1509db9c9e852a3b0f3070
80e607151ca69a45908b33b71d1ebfd50e41bd114808f8c8b5f6a18510124873
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
844d16730113c50876b1ea84b4ba3a56a4c0f115d04b8a25da0d558f1d799b00
849da4f976c9b84f358f42858d02c3464840a73f963ce4110006a423359fed7d
8569f8a54b841f9b5cbfbf1f340a1c29ee63e52b2fbf042d1b54bd9f5bcbbb07
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202
86bad3f0676ec6ada12bc991b7004d764e9d39b1c489ae7be7e0422c66d5a398
8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f
8784352d3d9a95ec8bff3ede98a66f89f629d7fc68c9723897d6e27dbd47d06b
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
89dcb924c8b66ef3591aa604353080212725871497ed027878db0743a76edc87
8e2f82ba358ede9370ae2bfe07ad79e6c9aa533ba777cb617199ece8e4b4f2aa
8e60f604f0ca5f472149b3e3a02c184ae1082ad59b54ce7eb26c1b6ff51ccfc4
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046
90782976683bb5396729c871848723e4c6a42cf1b5b73378fdca2ad84590a164
92e649098eefaf82db65282d7cbb4e65c738aca33c3fc8073a9c770fbcb0623d
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339
94883a3fdd8403e398bbf227bf669e0cc041256c80434070d356f41c743b35dc
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb
95c423bf8171e23d66d1b74a7f5bd90ad1806e8a3bea717280f9d71577389230
97719c71e44494e537beba8d51c6bb268a34dcd867fdefc431229225ca734b46
9863c7532e26b3e9a2e1ac1d7ee7d96bc03db512a2af9174aa5c1d07046376cd
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
99243101e035d021001b593b30807c0fb87761ab8f57fc4e6f2db1d8db77712c
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99dfaad0d22db1317db6463337f40111a17124c49f61df9e0404cf2865383b61
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9abe6b1f8f8e8903d93e62630394568dbbd09e4fdad84026e2374f3935d5d25f
9be72c32fdeb906bef7631bb3e4bc907d21208cbf704c000136113d1248de7d3
9c9f55123bff498d0ce32c3417c43af4a71ba9ef7b24aed3726ffe7bde67b18c
9cd1b5630bcc34ecc71dbcbdfe45ddb9ed3cb4c0464a2abeb76bcc490635e376
9cdb6bfef8d4212d9bf634ca6724a28e85dfa69cd404e6f9d3760d70a7873949
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0c22d6d57fad45533cd5b278af7bff077c00333e779d7e4349f6cb20e533840
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a10b1c7f97ebd8b3b97246dd00d29bfb860b9a203aedc81c8e94efbf59f6a8ef
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1e8d04c08daa0b25816d9fc58c5e3ac1444e002ac36f04ec01a20b324f8a552
a20ccaf6978bd71c43456b6bc78288abdc57c3b6fa987eecb2e9f59b69d384e1
a21060b05b4e4a70e3f9d26413bd3ee7222944ecb0ea68c3b137c209ff4986b5
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a3533670bcdbbf6bf66ca791ac7b15a88812fd3fa15691a48e86cf9d387a57d3
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4cce32b9c0361fb6b4f7b53647c9c0bd178c5ee12f954f4586e5c49e9c4cd2e
a719ab36590f5ed984818a3df00ef01eb78221a598b04902ee2f2b0d2bf71fb4
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7b5f5f96f81dea4efc53e1d4dae8b37c28bec27a45b42ccf604ee759e20caec
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8
a8b7069299acb7cecdf2bd4f42505d2cd5e08783754ef2a79d30f1f886f38a75
a8bc199ab83f0a2e461c4392fe72c773236576ce97f2db2228bb360ba58c483e
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
abd3d72d03f5b373f219487bd1c6823c71f1e7015b5540c4ec8ef0836a54924a
abdf06e636278b31f806066b5bca348d0aba0d7f8c2932e22d6f011fadb85a6e
abf1f225d33040f0846f89566a3908749c61ce74cc565e101432768054a65699
ac46b748a106dddd4f60471290a1994db96aa6f1a53aae424a8fd841efff8bfb
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ace5c7a57a33a8c21d81ff1ab27c6e2fb71d14c98f007bc9e990880063a32b42
ad47fb163aa0ec7784d307b56c29fe2ecc34b37588f3a8e086fb2baa7a524825
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50
af3fb4daf87b0fbb111931048be4b0672173d52619937a69dd00f46e9de24190
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1f8a83d3cc9d3c704e8520938e8bf6720434616fefd0f04dc98e2139d30bf5c
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1
b429dacc88a6a03aec0c4056dc1bbcf870fb47b1accc5a6d776aa46ec47dd44f
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b4e1164655d4f49235af7c4a51c4eccacbff1261e53ca7f72b1d8da8bde1ef94
b5071e0d9026ad157e994a31f51bc7d64c2f7ea6b342cb054f6ea8407a342d34
b52e00ba53f3251c17bf03da702ed83fc5d7bd2937aef4a7d034b01485f80032
b60f65161ce3517c2794eecab25981c51ffbcbc951a781270403e2f3572d0290
b630bfefb18b047f36806ca3d09555730a686f944adedef8ef6fabc3751b58f9
b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad
b73857582989f2602487dc4de28f9e84ec0f34dad3857a405137e60150e4bfa4
b8d92954490ffc41ab2023c7045e8d452d64e17826ebdc8f607b5fc97f0d83ee
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc740c3112caddaec0203f975f014756ba0aad2b52b76029e0752193bfa2829d
be2b278110fd329ff68ecfc79b0e3b65c817f3f46126588329b1ec48b1f839e4
c13d034eaf2fa73680d0abdbe02ac23b73e3128b5c7f0ee7018eb7b3fbe84a72
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c39238598cc03d4fbaab44e7f0b3d4552f8c2617e0203cf6c5f74ce5ada647a9
c399981a6bcd319b139bdce81ba6ff1f34528c7026c147d70edc6e560ef45d6e
c39f38776508cc2a307bc5b09b86446fb7ed06e2d0e77f0ba25639ed35cab1cd
c3f1108df7bbfe540c77dbde63875debd023b17b9fdcee9a9e44e4cf7c1d3b3a
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
c4c8d6c66cf7bb5cf29e1a2cda44dcbed9df8bd54fb633aa5a4afb9933b73156
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c7610165e7f527b5dae9ec4327ac81a68e0bef162a758b9a043d2a28b4b26341
c8092940d0da633c702f549149732cc636a04efd05b0bb72ae1b7a38b4a106aa
c8b895ad0d60f306a58616fa23f9fadd60919edbd25f4d3553388d693a90eda6
c8e01036126483d4c573355492a75ae65ae1722e9a927d41d9da4fafc8076612
ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3
cabdf43589214ad0231af8ec71b0ba10b72b5541a6a3238ac1b2d58cdac68329
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cc8ae86d2fa81aa6c449e05f20d1dd555932a98ea9f973a7f244533c733972bc
cd8a0611fc79f13600be6c8fa54956873c4b847ff63ecb69ae767fce13837b8b
cd8d822ef14852f2b0b8b6dc4090c56318c02ea89e01d5b639843bc1ff1b1f5c
cdb9820e4bfa57d0a170e049d2cd884e300c5bdf0c837e5924b6bbaf710c5545
cf26bdbf5ff75c910f2127a46e8d6feb959eeb10eaa979e58112dd0bc0f8a16e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfac05f501d6d4d62e29fff1049569c3c2aa8732af8db3a36e8fa252f05f5861
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d2410ea736ee79fb8b19cecec698d4da996c94b2355eee4cc61f0f9b6bda92c1
d2abe9d5f7eec7dfc53021326811dd6770437e66cd21623e7f92eac2bf95aa5a
d3875917853a017de272d67ba71ad727240056792fe20486e527f178dd5b8f0c
d42995148a2fc412f49e4411183636e9192a226fb4c3912e627655db7977284a
d700b57f2d2a20509c05ba3130977df9b7ca52f89aa886a5d7e49c7a7a44b91a
d85cc0cba3d32082355e73760d917f9cd6e96150229c18669a3472837c532395
d86e874d5af977ac1fbced09c5a7180b76f560ca8b5f85bdacf063654639dd76
d88b2c29e220c0c3c8749198cff8b84349394118272627dda591a6006c838ace
d8a34aeacc4054bd4e119e538c7eb4956421014f48a9b603d3f9314a7435b5a6
d8c62b0d4ac621bedd0ca5a4e96b12a77118338d4166f94d65c15bb154d455aa
d9473dc254914f26f7000bc3eacc42988538946d23e38b6a98f7648f22e13378
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd7bcaf63e84ebe38399409f74d3d9273fb3044e436bb5d8c2918531930a9c3f
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
df3d6be6cee7a0293e21c1b3dee050c2c1a913a5a753663df209345be77b443e
df888bff9ec6e7f70b4e273ccbbcc1adb8dd8b4c725ae2860ca434f51ff36bbf
e1023fc5b7b2cb762dd4ad14fcf4787fa945fca4a37518cd0d6b411c248dc201
e11652e7b04cdcc9c0bc7948055c05aaf8f7c066e6059d52f9b186c55368cb9e
e127dce391c5b30b9f8027fc7d0097db662ce9c6af8eef63207ffe4a1432b55d
e1402c0fb103864cc844f68be7e28378d9d19f0f80212e1c98b9c4cfebaf2bb4
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
e2cdec10db9a0a224e9f5e49b6f004c5426564fb8d857ad3df480e9c916bafe6
e2d868f56353cfa8f98f458b5bb7edf7585e67750a7dc681947d86c10f680499
e33b0e88e98b044bb7339fe15b58a8da3cdbb95ae3c5e5fec466f642ec7cc1a1
e3508fc61e7bce6b91542e3d167b537a94b8847b18254a90dc9d8d3956b79555
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3edd49af8ed269163573c4db713c58d123d31886498f6efed5b5c75383f82a1
e3ff3a3ce46613ebbf6cf9d70af506779dc37897b6c32c4435853672cb00ac74
e4a783177bbd97d5981bdc4b33b9bf4692fb715864e15dd9a693f339e7d01867
e4dbea8f7e75ac1a84c9d0fa8e977fa17ea8670f7e7a3158e0d32c8528c86395
e54c1167baa64850d460c27373205e6b3a36986cc12bacc531f0501ff6b7f90e
e579dc45dc35bc07014667ded505084755528742d89482c286142b1511a2f2fa
e7ae488440135f77c09eb0d8cbb5164fbbf7c26c725e55c7298aa866749c915d
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3
ea69b75b81243d7429f2762349a7b95e0fc43ca337db14df218371e656286357
eb2c939431e6250150a8cde81a5203d320e4e83df92c11a11e90b16074581e0e
eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977
edadd7b5710b054063f62ed5db4860a731b810f44202013af0d0114ba3c6c911
eeb973b10d01961e3eaaecf2791e13e4ea0c6c0f0241346b81248ee3505e4432
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05b8afebdc73dd7fba72a52adc8d698505e2012f6cfac604e5eba06bbeb8e53
f126db35d376ca52cb574fb35418df46562bcfd2cee5e8deab879a1d27e026d3
f2d93c219f91a38a44ec42951184d4a1d9a655597f908acf2daab59e1f6be99c
f3385adf33b15d77200af558761f6a92bbeeab7254fa981f16089d6ea81db1dd
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
f535d78d3a2fa8b7b96a666e3df3522d5dc7bab2d1d0dd5b82e1348b666fffcb
f6cc956692123800c8a7144ddd961da386e904a2dfe611358e068e1e08a02cf4
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3
f8c1826c85c5f3b574ff50bacbbf2f6260476649a6321a9fc69c9ae8b82f4031
fb845bc1998e818ffd1ebeacd695e0a60e479e5993e5f0053e34bff96b8d4c53
fc182daf225bb54bf268219eb3884cf5494f5f304337c9c1b9a9dfcb86d16fb7
fd2022bb1ec064ea24325b1fa9503e8766a3f90cc30a25f19ee5c7926d4ae074
ff420b26b8a33e1bcae39c4d165c2cc259681bbb7b32565dbd7644c1d84cbfa8