heimdalsecurity.com Open in urlscan Pro
52.157.161.254 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Submission: On October 21 via api (October 21st 2019, 6:24:10 pm UTC) from CH

Summary HTTP 90 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 22 IPs in 7 countries across 20 domains to perform 90 HTTP transactions. The main IP is 52.157.161.254, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is heimdalsecurity.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 5th 2018. Valid for: 2 years.

This is the only time heimdalsecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 55	52.157.161.254 52.157.161.254	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2	13.69.85.94 13.69.85.94	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	13.224.196.44 13.224.196.44	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
1	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:815::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
7	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:4001:81d::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	147.75.84.99 147.75.84.99	54825 (PACKET) (PACKET - Packet Host)
1	23.45.111.171 23.45.111.171	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	147.75.33.59 147.75.33.59	54825 (PACKET) (PACKET - Packet Host)
1	147.75.84.117 147.75.84.117	54825 (PACKET) (PACKET - Packet Host)
1 4	2.18.233.40 2.18.233.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
7 10	54.154.133.226 54.154.133.226	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1 1	2a00:1288:110... 2a00:1288:110:c305::9000	34010 (YAHOO-IRD) (YAHOO-IRD)
1 2	52.57.35.19 52.57.35.19	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	37.252.173.22 37.252.173.22	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
90	22

55 52.157.161.254 (Amsterdam, Netherlands) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

heimdalsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.69.85.94 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

pages.heimdalsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.196.44 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-224-196-44.fra2.r.cloudfront.net

clientcdn.pushengage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.99 (Parsippany, United States)

ASN54825 (PACKET - Packet Host, Inc., US)

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.111.171 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-111-171.deploy.static.akamaitechnologies.com

chimpstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.33.59 (Amsterdam, Netherlands)

ASN54825 (PACKET - Packet Host, Inc., US)
PTR: pkt-ams-k1-4

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.117 (Parsippany, United States)

ASN54825 (PACKET - Packet Host, Inc., US)

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.233.40 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-40.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 54.154.133.226 (Dublin, Ireland) 7 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-154-133-226.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::9000 (United Kingdom) 1 redirects

ASN34010 (YAHOO-IRD, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.35.19 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-57-35-19.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.173.22 (Ascension Island)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.72.21 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 21.72.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 147.120.95.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.194 (United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
57	heimdalsecurity.com 1 redirects heimdalsecurity.com pages.heimdalsecurity.com	1 MB
14	adroll.com 8 redirects s.adroll.com d.adroll.com	18 KB
7	gstatic.com fonts.gstatic.com	79 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	78 KB
3	doubleclick.net 3 redirects stats.g.doubleclick.net cm.g.doubleclick.net	665 B
3	gravatar.com secure.gravatar.com	8 KB
2	openx.net 1 redirects us-u.openx.net	341 B
2	bidswitch.net 1 redirects x.bidswitch.net	907 B
2	facebook.net connect.facebook.net	87 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	googleapis.com fonts.googleapis.com	2 KB
1	facebook.com www.facebook.com	246 B
1	rlcdn.com idsync.rlcdn.com	40 B
1	adnxs.com ib.adnxs.com	875 B
1	yahoo.com 1 redirects ads.yahoo.com	671 B
1	chimpstatic.com chimpstatic.com	510 B
1	google.de www.google.de	109 B
1	google.com 1 redirects www.google.com	191 B
1	googletagmanager.com www.googletagmanager.com	25 KB
1	pushengage.com clientcdn.pushengage.com	15 KB
90	20

	Domain	Requested by
55	heimdalsecurity.com	1 redirects heimdalsecurity.com
10	d.adroll.com	7 redirects s.adroll.com
7	fonts.gstatic.com	heimdalsecurity.com
4	s.adroll.com	1 redirects heimdalsecurity.com
3	secure.gravatar.com	heimdalsecurity.com
2	cm.g.doubleclick.net	2 redirects
2	us-u.openx.net	1 redirects
2	x.bidswitch.net	1 redirects
2	connect.facebook.net	s.adroll.com connect.facebook.net
2	www.google-analytics.com	heimdalsecurity.com
2	fonts.googleapis.com	heimdalsecurity.com
2	pages.heimdalsecurity.com	heimdalsecurity.com
1	www.facebook.com
1	idsync.rlcdn.com
1	ib.adnxs.com
1	ads.yahoo.com	1 redirects
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	chimpstatic.com	heimdalsecurity.com
1	static.hotjar.com	heimdalsecurity.com
1	www.google.de	heimdalsecurity.com
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	www.googletagmanager.com	heimdalsecurity.com
1	clientcdn.pushengage.com	heimdalsecurity.com
90	25

This site contains links to these domains. Also see Links.

Domain
twitter.com
ro.linkedin.com
pressone.ro
cybersecuritycourse.co
dailysecuritytips.com
learninfosec.co.uk
www.facebook.com
www.linkedin.com

Subject Issuer	Validity	Valid
*.heimdalsecurity.com DigiCert SHA2 Secure Server CA	`2018-06-05` - `2020-02-26`	2 years	crt.sh
*.googleapis.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
*.pushengage.com Amazon	`2019-03-26` - `2020-04-26`	a year	crt.sh
*.gravatar.com COMODO RSA Domain Validation Secure Server CA	`2018-09-06` - `2020-09-05`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2019-10-06` - `2020-01-04`	3 months	crt.sh
wildcardsan.us15.list-manage.com DigiCert ECC Secure Server CA	`2018-06-16` - `2019-12-15`	a year	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2019-10-06` - `2020-01-04`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2019-10-06` - `2020-01-04`	3 months	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2018-12-19` - `2020-03-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-09-22` - `2019-12-20`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2019-04-17` - `2020-05-04`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-24` - `2020-04-23`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh

This page contains 2 frames:

Primary Page: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Frame ID: 9F35407468890F963015FDA23C9F96B1
Requests: 90 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-74dcf4e32eff343c96838bf3a780ac1d.html
Frame ID: 385A0CA6FE0517A0AFC2E9349503F9A5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize HTTP 301
https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Lightbox (JavaScript Libraries) Expand

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

90
Requests

100 %
HTTPS

44 %
IPv6

20
Domains

25
Subdomains

22
IPs

7
Countries

1384 kB
Transfer

2981 kB
Size

4
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/miriam_cih

Search URL Search Domain Scan URL

URL: https://ro.linkedin.com/in/miriam-cihodariu

Search URL Search Domain Scan URL

URL: https://pressone.ro/curiosul-caz-al-celor-cinci-pagini-false-digi24
Title: HERE

Search URL Search Domain Scan URL

URL: http://cybersecuritycourse.co/
Title: Cyber Security Course for Beginners

Search URL Search Domain Scan URL

URL: https://dailysecuritytips.com/
Title: THE DAILY SECURITY TIP

Search URL Search Domain Scan URL

URL: https://learninfosec.co.uk/
Title: CYBER SECURITY FOR SMALL BUSINESS OWNERS

Search URL Search Domain Scan URL

URL: https://twitter.com/HeimdalSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/HeimdalSec

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/heimdal-security/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize HTTP 301
https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&gjid=1793390555&_gid=1146576206.1571682234&_u=IGBAgAAB~&z=962087748 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&_v=j79&z=962087748 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&_v=j79&z=962087748&slf_rd=1&random=141039965

Request Chain 78

https://s.adroll.com/j/exp/P6EQKMLZI5FIFB3TRJ7KKP/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 80

https://d.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&pv=98838348939.4149&cookie=&adroll_s_ref=&keyw=&arrfrr=https%3A%2F%2Fheimdalsecurity.com%2Fblog%2Fscam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize%2F HTTP 302
https://s.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM/MXYH5RBOOVG7XIRYWEYUBK.js

Request Chain 82

https://d.adroll.com/cm/r/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP HTTP 302
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 83

https://d.adroll.com/cm/b/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM

Request Chain 84

https://d.adroll.com/cm/x/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP HTTP 302
https://ib.adnxs.com/setuid?entity=172&code=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM

Request Chain 85

https://d.adroll.com/cm/l/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP HTTP 302
https://idsync.rlcdn.com/377928.gif?partner_uid=0f30dfe0006137127ae9ca84c3175c83

Request Chain 86

https://d.adroll.com/cm/o/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=0f30dfe0006137127ae9ca84c3175c83 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0f30dfe0006137127ae9ca84c3175c83

Request Chain 87

https://d.adroll.com/cm/g/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP&google_nid=adroll5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=DzDf4ABhNxJ66cqEwxdcgw HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=DzDf4ABhNxJ66cqEwxdcgw&google_tc= HTTP 302
https://d.adroll.com/cm/g/in

90 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Redirect Chain

https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize
https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

58 KB
14 KB

19ms
19ms

Document
text/html

52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

ed6a7cfa5e338448b1f64bbfde7355e5b372adb484d943f736c0b14b1c4dd397

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: heimdalsecurity.com
:scheme: https
:path: /blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Mon, 21 Oct 2019 18:23:53 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding, Cookie
link: <https://heimdalsecurity.com/blog/?p=15163>; rel=shortlink
content-encoding: gzip
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

Redirect headers

status: 301
server: nginx
date: Mon, 21 Oct 2019 18:23:53 GMT
content-type: text/html
content-length: 194
location: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 styles.css
heimdalsecurity.com/blog/wp-content/plugins/click-to-tweet-by-todaymade/assets/css/ 3 KB
1009 B 15ms
11ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/click-to-tweet-by-todaymade/assets/css/styles.css?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

a7260c89998dba51ffa677ea4292848fa9a3d364b013cb5ed5808976b42e02ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:11 GMT
server: nginx
etag: W/"5cdab2b7-cea"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK blackfriday-campaign.css
pages.heimdalsecurity.com/assets/css/ 7 KB
8 KB 90ms
12ms Stylesheet
text/css 13.69.85.94
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://pages.heimdalsecurity.com/assets/css/blackfriday-campaign.css?ver=4.9.10
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.69.85.94 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: 2d5cb833f7c6f72d7bf4f116c1d09d3132fe8aa4aa7acc4ab7b8a6961bdad1e2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 21 Oct 2019 18:23:53 GMT
Last-Modified: Fri, 23 Nov 2018 10:25:17 GMT
Server: nginx
ETag: "5bf7d58d-1d95"
Content-Type: text/css
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7573
Expires: Wed, 20 Nov 2019 18:23:53 GMT

GET
H2 200 style.css
heimdalsecurity.com/blog/wp-content/plugins/heimdal-social-sharing-buttons/css/ 3 KB
1 KB 17ms
13ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/heimdal-social-sharing-buttons/css/style.css?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

2490f71eb2731918773ffee635684f71d90191687cec90809c837a6787af8eb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:32 GMT
server: nginx
etag: W/"5cdab2cc-c9b"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 player-style.css
heimdalsecurity.com/blog/wp-content/plugins/html5-audio-player/style/ 24 KB
4 KB 18ms
14ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/html5-audio-player/style/player-style.css?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

11b7448c22b34dae17fdace8778630f6e9bab3e826c1a1ca960284359ab453b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:31 GMT
server: nginx
etag: W/"5cdab2cb-5edb"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 bootstrap.css
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/ 143 KB
21 KB 29ms
26ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/bootstrap.css?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

15d9b210b1042e0e83d5e90de78984dbed52d5fe53085e8a5867a32cc758962c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-23c14"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 font-awesome.min.css
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/ 28 KB
7 KB 19ms
16ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/font-awesome.min.css?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

7bc15c522a05ce0e56b8cb3fff83bc6e770130afdd840d469869db69663d78fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-7186"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 lightbox.min.css
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/ 3 KB
1 KB 19ms
15ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/lightbox.min.css?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

5595963bca2af38bc8e44b3447f2fbe26d3d552b151e0d2cba04530609cf6676

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-af0"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 style.css
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/ 58 KB
11 KB 31ms
27ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/style.css?ver=1

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

de9f3ac6d172868eefdccdf3661c43fb5634d5a0154a520611735639f77fb451

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 14 Oct 2019 13:32:50 GMT
server: nginx
etag: W/"5da47902-e99a"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 css
fonts.googleapis.com/ 28 KB
1 KB 19ms
16ms Stylesheet
text/css 2a00:1450:4001:821::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A500%2C900italic%2C400%2C400italic%2C100%2C700italic%2C300%2C700%2C500italic%2C100italic%2C300italic%2C900&ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 21 Oct 2019 18:23:53 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Mon, 21 Oct 2019 18:23:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 21 Oct 2019 18:23:53 GMT

GET
H2 200 css
fonts.googleapis.com/ 5 KB
684 B 18ms
16ms Stylesheet
text/css 2a00:1450:4001:821::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab%3A400%2C700&ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e58c39ba17562db2e291a8ba0bc7c81a689f3bc4993b9597805ac8ef996c220c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 21 Oct 2019 18:23:53 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Mon, 21 Oct 2019 18:23:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 21 Oct 2019 18:23:53 GMT

GET
H2 200 default.min.css
heimdalsecurity.com/blog/wp-content/plugins/tablepress/css/ 6 KB
3 KB 18ms
15ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/tablepress/css/default.min.css?ver=1.9.2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 09 Sep 2019 07:57:03 GMT
server: nginx
etag: W/"5d7605cf-16ef"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 frontend.css
heimdalsecurity.com/blog/wp-content/plugins/heimdal-blog-cro/css/ 7 KB
2 KB 33ms
30ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/heimdal-blog-cro/css/frontend.css?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

799afe05fe88dbb1d4ca9367635c10122fb4ae9f3143d4e1756547a60d55486d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:11 GMT
server: nginx
etag: W/"5cdab2b7-1dee"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 EnlighterJS.min.css
heimdalsecurity.com/blog/wp-content/plugins/enlighter/resources/ 36 KB
7 KB 32ms
30ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/enlighter/resources/EnlighterJS.min.css?ver=3.10.0

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Apr 2019 11:39:32 GMT
server: nginx
etag: W/"5cc6e274-8f0d"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 style.min.css
heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/ 11 KB
2 KB 17ms
15ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/style.min.css?ver=6.33

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

90f944f98912737cd582f7fadf149e9d2d064adc8fdf6f0621ba0a20dd68493a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:50 GMT
server: nginx
etag: W/"5cdab2a2-2a58"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 link-buttons.min.css
heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/ 6 KB
1 KB 31ms
28ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/link-buttons.min.css?ver=6.33

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

2ac03a4c7aff60dbd686171c3bb784e852d75a0449720e7885d533b612a72dc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:50 GMT
server: nginx
etag: W/"5cdab2a2-1621"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 animate.min.css
heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/ 58 KB
4 KB 29ms
27ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/animate.min.css?ver=6.33

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

d6f19a46db129c5750b9d448c369b7910e9c3980d6ac72b683782f269070a5cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:50 GMT
server: nginx
etag: W/"5cdab2a2-e965"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 spinkit.min.css
heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/ 17 KB
2 KB 31ms
29ms Stylesheet
text/css 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/layered-popups/css/spinkit.min.css?ver=6.33

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

347397795aa18445b8861779c68d70b2fc592b4aebf7941aa6b7a9aef06c5375

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:50 GMT
server: nginx
etag: W/"5cdab2a2-4200"
x-frame-options: SAMEORIGIN
content-type: text/css
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 jquery.js Show response
heimdalsecurity.com/blog/wp-includes/js/jquery/ 95 KB
33 KB 41ms
39ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:19:00 GMT
server: nginx
etag: W/"5cdab234-17ba0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 plyr.js Show response
heimdalsecurity.com/blog/wp-content/plugins/html5-audio-player/js/ 111 KB
31 KB 32ms
30ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/html5-audio-player/js/plyr.js?ver=1

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

f0abd7b0fbb053a03343edcba1216667880ce4457b3d62c66bf8064b1fd2f657

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:31 GMT
server: nginx
etag: W/"5cdab2cb-1bd9a"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK 380d288a0f223de9a81e026f47b6e7b8.js Show response
clientcdn.pushengage.com/core/ 58 KB
15 KB 37ms
19ms Script
application/javascript 13.224.196.44
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://clientcdn.pushengage.com/core/380d288a0f223de9a81e026f47b6e7b8.js
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.196.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-224-196-44.fra2.r.cloudfront.net
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: b46e09f6c0ee1ed65eade148280444edd210e54034a0c20f8e586b44e8267315

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 21 Oct 2019 18:22:11 GMT
Content-Encoding: gzip
Server: nginx/1.4.6 (Ubuntu)
X-Amz-Cf-Pop: FRA2-C1
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, s-maxage=120
Transfer-Encoding: chunked
Connection: keep-alive
X-Amz-Cf-Id: jj7rszU3CUe45iKSXCGeZO_VQmS9C0hx0XUUwEIBxUSrZfHSjjJGrA==
Via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)

GET
H2 200 heimdal-logo.svg
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/ 6 KB
3 KB 40ms
39ms Image
image/svg+xml 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/heimdal-logo.svg

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

a2953e22f7b3afac6b55791bd52cd4c349d27035b1f6fddab86c585b271bdf60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 10 Oct 2019 13:13:58 GMT
server: nginx
etag: W/"5d9f2e96-1908"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 80874c81aa4871787a40780d7b0c01eb
secure.gravatar.com/avatar/ 4 KB
5 KB 48ms
12ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/80874c81aa4871787a40780d7b0c01eb?s=120&d=mm&r=g
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 9c073fdceba86c6fa3561b67d66f87c7d2e36ace8f1ec539b5305985c0773813

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT vie 4
date: Mon, 21 Oct 2019 18:23:53 GMT
last-modified: Tue, 05 Mar 2019 11:12:01 GMT
server: nginx
source-age: 9890117
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="80874c81aa4871787a40780d7b0c01eb.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/80874c81aa4871787a40780d7b0c01eb?s=120&d=mm&r=g>; rel="canonical"
content-length: 4369
expires: Mon, 21 Oct 2019 18:28:53 GMT

GET
H2 200 0_google_serp-1.png
heimdalsecurity.com/blog/wp-content/uploads/ 37 KB
38 KB 18ms
16ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/0_google_serp-1.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

9ab534712eaaadb46bded7f13f60337ce4ad05476f07328f1670d9cfcfbc2e70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Oct 2019 14:03:46 GMT
server: nginx
etag: "5d9c9742-94ce"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 38094
x-xss-protection: 1; mode=block

GET
H2 200 1-2.png
heimdalsecurity.com/blog/wp-content/uploads/ 32 KB
33 KB 18ms
16ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/1-2.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

093f793b6c3610bba76c878b4a0a1ec692d30afbc71aa239816ee16e88b7e8b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Oct 2019 14:03:56 GMT
server: nginx
etag: "5d9c974c-80ef"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 33007
x-xss-protection: 1; mode=block

GET
H2 200 2-2.png
heimdalsecurity.com/blog/wp-content/uploads/ 27 KB
27 KB 42ms
40ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/2-2.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

4bd45343c9962891995b13160bc4860a2d7a23d003b28c14582b5217e07e3b8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Oct 2019 14:04:28 GMT
server: nginx
etag: "5d9c976c-6a00"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 27136
x-xss-protection: 1; mode=block

GET
H2 200 3-1.png
heimdalsecurity.com/blog/wp-content/uploads/ 31 KB
31 KB 25ms
23ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/3-1.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

1cc5b433a54bd6b44fed0070918d184416033b19325d2359f114944af961e7f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Oct 2019 14:05:05 GMT
server: nginx
etag: "5d9c9791-7b52"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 31570
x-xss-protection: 1; mode=block

GET
H2 200 4-1.png
heimdalsecurity.com/blog/wp-content/uploads/ 249 KB
250 KB 29ms
27ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/4-1.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

08934174e55fa6aeb2ade3dced4674586ed79ba37aa917f7bd5028cd6b35d1f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Oct 2019 14:05:45 GMT
server: nginx
etag: "5d9c97b9-3e374"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 254836
x-xss-protection: 1; mode=block

GET
H2 200 5-1.png
heimdalsecurity.com/blog/wp-content/uploads/ 232 KB
233 KB 25ms
24ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/5-1.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a97f322d23ea7d63f7e75b56bf3df563a2c71d08c3ef9a86fab9dffcc308b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Oct 2019 14:06:46 GMT
server: nginx
etag: "5d9c97f6-39fdb"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 237531
x-xss-protection: 1; mode=block

GET
H2 200 subscribe-newsletter.jpg
heimdalsecurity.com/blog/wp-content/uploads/ 2 KB
2 KB 43ms
41ms Image
image/jpeg 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/subscribe-newsletter.jpg

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

7233427f6810a2e739af4c73fec0933ea969f9f81a46c9060b888e7f6910f54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:31 GMT
server: nginx
etag: "5cdab28f-778"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1912
x-xss-protection: 1; mode=block

GET
H2 200 heimdal-simple-logo.png
heimdalsecurity.com/blog/wp-content/uploads/ 2 KB
2 KB 30ms
29ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/heimdal-simple-logo.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

bd8e8ced8db041de50ad0bc10dfeddbcc895707d642512b85afb3e906bac5e10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:44 GMT
server: nginx
etag: "5cdab29c-8b9"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 2233
x-xss-protection: 1; mode=block

GET
H2 200 0ce65f94060bf1e1150fcdb04b7eff6c
secure.gravatar.com/avatar/ 1 KB
1 KB 48ms
13ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/0ce65f94060bf1e1150fcdb04b7eff6c?s=50&d=mm&r=g
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 707a3f9a6fc5e63cd997c2e751a08e36caf4441e65b351b86c5de65fd832f063

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Mon, 21 Oct 2019 18:23:53 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
source-age: 474297
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="0ce65f94060bf1e1150fcdb04b7eff6c.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/0ce65f94060bf1e1150fcdb04b7eff6c?s=50&d=mm&r=g>; rel="canonical"
content-length: 1128
expires: Mon, 21 Oct 2019 18:28:53 GMT

GET
H2 200 80874c81aa4871787a40780d7b0c01eb
secure.gravatar.com/avatar/ 2 KB
2 KB 48ms
13ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/80874c81aa4871787a40780d7b0c01eb?s=50&d=mm&r=g
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: b7f9aeeefcefcda53d79b74210384708eb96c604bb336ee4d4e41f58c63fe0de

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT vie 3
date: Mon, 21 Oct 2019 18:23:53 GMT
last-modified: Tue, 05 Mar 2019 11:12:01 GMT
server: nginx
source-age: 9833417
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="80874c81aa4871787a40780d7b0c01eb.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/80874c81aa4871787a40780d7b0c01eb?s=50&d=mm&r=g>; rel="canonical"
content-length: 1810
expires: Mon, 21 Oct 2019 18:28:53 GMT

GET
H2 200 heimdal-footer-logo.svg
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/ 8 KB
4 KB 28ms
27ms Image
image/svg+xml 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/heimdal-footer-logo.svg

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

4ac8c13b27d96ddfce0b1548ceb1c8ae3de7d1a5c773a50dbafcae943fd22aeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 10 Oct 2019 13:13:58 GMT
server: nginx
etag: W/"5d9f2e96-1fea"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 jquery.plugin.js Show response
heimdalsecurity.com/js/new/ 14 KB
5 KB 15ms
15ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/js/new/jquery.plugin.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

252ba0587b0a24f354c1cca69a67dbe190ed3cb49b530b60d652f7b8887d29d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 01 Aug 2019 08:53:11 GMT
server: nginx
etag: W/"5d42a877-39d3"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Wed, 20 Nov 2019 18:23:53 GMT

GET
H2 200 jquery.countdown.js Show response
heimdalsecurity.com/js/new/ 39 KB
10 KB 15ms
15ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/js/new/jquery.countdown.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

e8c924341999bd9f3dbe1535ce57672bcb71bfdcd338af43723de11eddb3f927

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 01 Aug 2019 08:53:11 GMT
server: nginx
etag: W/"5d42a877-9a96"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Wed, 20 Nov 2019 18:23:53 GMT

GET
H/1.1 200
OK blog-thor.js Show response
pages.heimdalsecurity.com/assets/js/ 1 KB
2 KB 35ms
11ms Script
application/javascript 13.69.85.94
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://pages.heimdalsecurity.com/assets/js/blog-thor.js
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.69.85.94 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: 831866373d9de6a09a1c407503c26cd7ade7ac2cccf520ff84ddd7c3b0ca8b1c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 21 Oct 2019 18:23:53 GMT
Last-Modified: Thu, 27 Sep 2018 13:34:42 GMT
Server: nginx
ETag: "5bacdc72-51f"
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1311
Expires: Wed, 20 Nov 2019 18:23:53 GMT

GET
H2 200 social.js Show response
heimdalsecurity.com/blog/wp-content/plugins/heimdal-social-sharing-buttons/js/ 1 KB
732 B 14ms
14ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/heimdal-social-sharing-buttons/js/social.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

4b676cf8499ae3f9408d905a3e6b8cde4a25cb165411639a5da2a9c6aa9295fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:31 GMT
server: nginx
etag: W/"5cdab2cb-4cb"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 voicer.min.js Show response
heimdalsecurity.com/blog/wp-content/plugins/voicer/js/ 8 KB
3 KB 14ms
14ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/voicer/js/voicer.min.js?ver=1.0.0

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

f8297a1a9801fb95e677acca571b01829c8ffa5a74b91c355b5416bbc15643a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 03 Jul 2019 11:44:06 GMT
server: nginx
etag: W/"5d1c9506-1f3e"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 bootstrap.min.js Show response
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/ 36 KB
10 KB 15ms
15ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/bootstrap.min.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-9004"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 lightbox.min.js Show response
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/ 8 KB
3 KB 14ms
14ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/lightbox.min.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

7f36de4455b10ca52ae3e585dc4cafd63851715da1ae3e4b2439f66ac045ebfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-2128"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 jquery.readingTime.js Show response
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/ 3 KB
2 KB 14ms
12ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/jquery.readingTime.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

458a280b395d136f1e67b67b93aeebb0fcd75b8783a489e0c3a5989453a3cea4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-cf0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 comment-reply.min.js Show response
heimdalsecurity.com/blog/wp-includes/js/ 1 KB
857 B 17ms
14ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-includes/js/comment-reply.min.js?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:19:00 GMT
server: nginx
etag: W/"5cdab234-436"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 jquery.validate.min.js Show response
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/ 22 KB
8 KB 18ms
15ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/jquery.validate.min.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

7836abd3871f857f1d6c2e1354979afca303a088dd80670ebb9829b0262ec170

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-59f3"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 script.js Show response
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/ 13 KB
4 KB 25ms
22ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/js/script.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

e1a7d4a226bbfff132032088b8da0daaa0dba4e5a9da23da71a582fec0e58def

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-35fd"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 frontend.js Show response
heimdalsecurity.com/blog/wp-content/plugins/heimdal-blog-cro/js/ 4 KB
2 KB 18ms
15ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/heimdal-blog-cro/js/frontend.js?ver=1.0.0

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

45d943e6064d6c659c986279b288a37572ce41d8fa322feae4f70b846570af3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:11 GMT
server: nginx
etag: W/"5cdab2b7-e84"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 mootools-core-yc.js Show response
heimdalsecurity.com/blog/wp-content/plugins/enlighter/resources/ 88 KB
28 KB 43ms
41ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/enlighter/resources/mootools-core-yc.js?ver=3.10.0

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Apr 2019 11:39:32 GMT
server: nginx
etag: W/"5cc6e274-15e0e"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 EnlighterJS.min.js Show response
heimdalsecurity.com/blog/wp-content/plugins/enlighter/resources/ 49 KB
15 KB 31ms
28ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/enlighter/resources/EnlighterJS.min.js?ver=3.10.0

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 29 Apr 2019 11:39:32 GMT
server: nginx
etag: W/"5cc6e274-c395"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 script.min.js Show response
heimdalsecurity.com/blog/wp-content/plugins/layered-popups/js/ 48 KB
10 KB 42ms
40ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/layered-popups/js/script.min.js?ver=6.33

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

5a4a9f4076fc96fb244f92a12a017c93917f5d7c14f91c398faf43f6b634b1ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:49 GMT
server: nginx
etag: W/"5cdab2a1-c1ed"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 wp-embed.min.js Show response
heimdalsecurity.com/blog/wp-includes/js/ 1 KB
1021 B 26ms
23ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-includes/js/wp-embed.min.js?ver=4.9.10

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:19:01 GMT
server: nginx
etag: W/"5cdab235-57b"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 form.js Show response
heimdalsecurity.com/blog/wp-content/plugins/akismet/_inc/ 700 B
586 B 23ms
22ms Script
application/javascript 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/plugins/akismet/_inc/form.js?ver=4.1

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:21:12 GMT
server: nginx
etag: W/"5cdab2b8-2bc"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 75 KB
25 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:81a::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PRSV4QF

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

60e65a3d4adf666063047c8bd405a731c68a83b5de8d4f892c06fa357a26a7c0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: br
last-modified: Mon, 21 Oct 2019 18:00:00 GMT
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25651
x-xss-protection: 0
expires: Mon, 21 Oct 2019 18:23:53 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:815::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 1784
date: Mon, 21 Oct 2019 17:54:09 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Mon, 21 Oct 2019 19:54:09 GMT

GET
H2 200 drop_light_blue.svg
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/svg/ 343 B
519 B 33ms
33ms Image
image/svg+xml 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/svg/drop_light_blue.svg

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

ae79ef8a171c02a3c7de6d2bb6a5f6a5c2fd165fe719d2b68242c4017fa9705d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/style.css?ver=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-157"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 Miriam-Digi-1030x360.png
heimdalsecurity.com/blog/wp-content/uploads/ 18 KB
19 KB 36ms
36ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/uploads/Miriam-Digi-1030x360.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

6dca8a37c1b0cb65330af9a470df0563a1fc6bc02bf379f07c0101c15fcf85b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 08 Oct 2019 13:58:06 GMT
server: nginx
etag: "5d9c95ee-49ba"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 18874
x-xss-protection: 1; mode=block

GET
H2 200 yellow_arrow.svg
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/svg/ 378 B
535 B 35ms
35ms Image
image/svg+xml 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/svg/yellow_arrow.svg

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

ba089dc1a67eec11482dc4b2c9322dc2abe7d00fd7a721593ff901a4dc879297

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/style.css?ver=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-17a"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 red_thunder.svg
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/svg/ 286 B
490 B 36ms
35ms Image
image/svg+xml 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/svg/red_thunder.svg

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

faa6cd619c2cc2d1741d4c2018a1988eb291a803c7d3a7b5bddc3df6584999f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/style.css?ver=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: W/"5cdab29f-11e"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-xss-protection: 1; mode=block

GET
H2 200 shadow.png
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/ 57 KB
57 KB 38ms
37ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/shadow.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

dbf1552257dbdff9b53c6f3b5ba8aa1092ded30ed72b30513e6ff197a43f9b55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/style.css?ver=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: "5cdab29f-e465"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 58469
x-xss-protection: 1; mode=block

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A500%2C900italic%2C400%2C400italic%2C100%2C700italic%2C300%2C700%2C500italic%2C100italic%2C300italic%2C900&ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 17:55:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 865718
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11016
x-xss-protection: 0
expires: Sat, 10 Oct 2020 17:55:15 GMT

GET
H2 200 close.png
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/ 280 B
523 B 34ms
25ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/close.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/lightbox.min.css?ver=4.9.10
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: "5cdab29f-118"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 280
x-xss-protection: 1; mode=block

GET
H2 200 loading.gif
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/ 8 KB
9 KB 33ms
24ms Image
image/gif 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/loading.gif

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/lightbox.min.css?ver=4.9.10
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: "5cdab29f-211c"
x-frame-options: SAMEORIGIN
content-type: image/gif
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 8476
x-xss-protection: 1; mode=block

GET
H2 200 prev.png
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/ 1 KB
2 KB 34ms
25ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/prev.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/lightbox.min.css?ver=4.9.10
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: "5cdab29f-550"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1360
x-xss-protection: 1; mode=block

GET
H2 200 next.png
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/ 1 KB
2 KB 33ms
25ms Image
image/png 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/images/next.png

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/lightbox.min.css?ver=4.9.10
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: "5cdab29f-546"
x-frame-options: SAMEORIGIN
content-type: image/png
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1350
x-xss-protection: 1; mode=block

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 12ms
5ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A500%2C900italic%2C400%2C400italic%2C100%2C700italic%2C300%2C700%2C500italic%2C100italic%2C300italic%2C900&ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 08 Oct 2019 20:54:21 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 1114172
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11056
x-xss-protection: 0
expires: Wed, 07 Oct 2020 20:54:21 GMT

GET
H2 200 glyphicons-halflings-regular.woff2
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/fonts/ 18 KB
18 KB 33ms
25ms Font
application/octet-stream 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/fonts/glyphicons-halflings-regular.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/bootstrap.css?ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: "5cdab29f-466c"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 18028
x-xss-protection: 1; mode=block

GET
H2 200 BngRUXZYTXPIvIBgJJSb6u92w7CGwR2oefDo.woff2
fonts.gstatic.com/s/robotoslab/v9/ 11 KB
11 KB 12ms
5ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v9/BngRUXZYTXPIvIBgJJSb6u92w7CGwR2oefDo.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4901c9453014d8e210b2f62189f68c2d7964543517e1fc8447924de7d542058a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab%3A400%2C700&ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 10 Oct 2019 08:40:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:27:03 GMT
server: sffe
age: 985408
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11388
x-xss-protection: 0
expires: Fri, 09 Oct 2020 08:40:25 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 11ms
4ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A500%2C900italic%2C400%2C400italic%2C100%2C700italic%2C300%2C700%2C500italic%2C100italic%2C300italic%2C900&ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 08 Oct 2019 20:40:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:52 GMT
server: sffe
age: 1114988
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11180
x-xss-protection: 0
expires: Wed, 07 Oct 2020 20:40:45 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 10ms
3ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A500%2C900italic%2C400%2C400italic%2C100%2C700italic%2C300%2C700%2C500italic%2C100italic%2C300italic%2C900&ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 10 Oct 2019 08:23:20 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 986433
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11020
x-xss-protection: 0
expires: Fri, 09 Oct 2020 08:23:20 GMT

GET
H2 200 fontawesome-webfont.woff2
heimdalsecurity.com/blog/wp-content/themes/heimdalv2/fonts/ 70 KB
71 KB 31ms
24ms Font
application/octet-stream 52.157.161.254
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/fonts/fontawesome-webfont.woff2?v=4.6.3

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.157.161.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

nginx /

Resource Hash

7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://heimdalsecurity.com/blog/wp-content/themes/heimdalv2/css/font-awesome.min.css?ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 14 May 2019 12:20:47 GMT
server: nginx
etag: "5cdab29f-118d8"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
status: 200
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 71896
x-xss-protection: 1; mode=block

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 12 KB
13 KB 13ms
6ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto%3A500%2C900italic%2C400%2C400italic%2C100%2C700italic%2C300%2C700%2C500italic%2C100italic%2C300italic%2C900&ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 15 Oct 2019 02:07:24 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:19:00 GMT
server: sffe
age: 576989
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 12680
x-xss-protection: 0
expires: Wed, 14 Oct 2020 02:07:24 GMT

GET
H2 200 BngMUXZYTXPIvIBgJJSb6ufN5qWr4xCC.woff2
fonts.gstatic.com/s/robotoslab/v9/ 11 KB
11 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:816::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v9/BngMUXZYTXPIvIBgJJSb6ufN5qWr4xCC.woff2

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c68d891f07355e5d0807b4a4f18ac8f16f6e9088277be3134c7efa570022ab2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab%3A400%2C700&ver=4.9.10
Origin: https://heimdalsecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 00:01:22 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:19:23 GMT
server: sffe
age: 930151
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11272
x-xss-protection: 0
expires: Sat, 10 Oct 2020 00:01:22 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
100 B 6ms
6ms Image
image/gif 2a00:1450:4001:815::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j79&a=1989411750&t=pageview&_s=1&dl=https%3A%2F%2Fheimdalsecurity.com%2Fblog%2Fscam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize%2F&ul=en-us&de=UTF-8&dt=Scam%20Alert%3A%20Digi%20Phishing%20Campaign%20Detected%2C%20Asking%20Credentials%20for%20a%20Prize&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IGBAgAAB~&jid=1905522329&gjid=1793390555&cid=1643920230.1571682234&tid=UA-52749460-1&_gid=1146576206.1571682234&z=718149142

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Oct 2019 11:06:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 890261
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&gjid=1793390555&_gid=1146576206.1571682234&_u=IGBAgAAB~&z=962087748
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&_v=j79&z=962087748
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&_v=j79&z=962087748&slf_rd=1&random=141039965

42 B
109 B

29ms
28ms

Image
image/gif

2a00:1450:4001:819::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&_v=j79&z=962087748&slf_rd=1&random=141039965

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:53 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-52749460-1&cid=1643920230.1571682234&jid=1905522329&_v=j79&z=962087748&slf_rd=1&random=141039965
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hotjar-58.js Show response
static.hotjar.com/c/ 20 KB
5 KB 13ms
12ms Script
application/javascript 147.75.84.99
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-58.js?sv=6

Requested by

Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.84.99 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),

Reverse DNS

Software

openresty /

Resource Hash

5b52b65dc4402a3e86ad166b8547ddc3602440b3621c87e692a1f464c3a0e20e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
section-io-tag: hotjar
age: 149
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 4565
server: openresty
cache-control: max-age=60
x-frame-options: SAMEORIGIN
etag: W/916712bbae04035fd757c52fc41e2c9c
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.071
section-io-id: a6b375b65928f10a48e19877c4141c64
accept-ranges: bytes
content-type: application/javascript

GET
H/1.1 200
OK 97737495b7a5296ee4586cdbf.js Show response
chimpstatic.com/mcjs-connected/js/users/9588e79f21453dd8e52df4d68/ 50 B
510 B 18ms
6ms Script
application/javascript 23.45.111.171
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://chimpstatic.com/mcjs-connected/js/users/9588e79f21453dd8e52df4d68/97737495b7a5296ee4586cdbf.js
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.45.111.171 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-111-171.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f6e4f5edb3194334a199f0bf80b38d92a0b7388330fbce94c8c0fb2f852c171f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 21 Oct 2019 18:23:53 GMT
Last-Modified: Tue, 05 Mar 2019 18:02:44 GMT
Server: AmazonS3
x-amz-request-id: 2C5D889026211A8D
ETag: "104d46a3208b40e8ded389332f5a78a3"
Content-Type: application/javascript
Cache-Control: max-age=363
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 50
x-amz-id-2: Fffpe9RWHhPQ6Vb00+1FmfUPV96a1xmIouY5yyJGsgS1HXhYDC8aTzo/Z5VQG10OSnq69X1p7i4=
Expires: Mon, 21 Oct 2019 18:29:56 GMT

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 modules.9c427faaa7393368f30c.js Show response
script.hotjar.com/ 433 KB
73 KB 56ms
18ms Script
application/javascript 147.75.33.59
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.9c427faaa7393368f30c.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-58.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.33.59 Amsterdam, Netherlands, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS: pkt-ams-k1-4
Software: /
Resource Hash: 8f98d1e3eefb7d26d9a1fbe17b046769afb0335b4dccd5a0861fc77d7833db70

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:53 GMT
content-encoding: br
last-modified: Mon, 21 Oct 2019 09:50:58 GMT
status: 200
etag: "1dbb6c845721a7274de1e15b07fb79e8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.042
section-io-origin-status: 200
accept-ranges: bytes
section-io-id: 7b21f0496dcd6e40c4fed7500bb3befa
content-length: 74442

GET
H2 200 box-74dcf4e32eff343c96838bf3a780ac1d.html
vars.hotjar.com/ Frame 385A 0
0 56ms
18ms Document
text/html 147.75.84.117
Packet Host

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-74dcf4e32eff343c96838bf3a780ac1d.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-58.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.84.117 Parsippany, United States, ASN54825 (PACKET - Packet Host, Inc., US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-74dcf4e32eff343c96838bf3a780ac1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/

Response headers

status: 200
date: Mon, 21 Oct 2019 18:23:53 GMT
content-type: text/html
content-length: 808
cache-control: max-age=31536000
content-encoding: br
last-modified: Thu, 17 Oct 2019 10:26:51 GMT
etag: "e97b43816dfbff056689db51ae5cdfc7"
section-io-origin-status: 200
section-io-origin-time-seconds: 0.027
vary: Accept-Encoding
accept-ranges: bytes
section-io-id: c118a072d73082a039f53a6837f3e6d7

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 33 KB
11 KB 18ms
7ms Script
text/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: heimdalsecurity.com
URL: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 880a2e81641380a4609a464aa6c813ba5a47f953ea354c1f08eb4f0706409ccd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: CdVV7j36_NrWhaa2SL8tgFNc7xBcb0ts
Content-Encoding: gzip
ETag: "1ab416151418a84e04dca50b27b312ee"
x-amz-request-id: 08D1DCF34EAC8E13
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 10541
x-amz-id-2: G+JPo5NDEcKiqcoT4lO6aZsxZ0nOfRZGSyskSS3y8WygGJ+d6VLhM11OiRu6QQfLoJR2ArSHTPc=
Last-Modified: Mon, 21 Oct 2019 16:57:14 GMT
Server: AmazonS3
Date: Mon, 21 Oct 2019 18:23:54 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/P6EQKMLZI5FIFB3TRJ7KKP/index.js
https://s.adroll.com/j/exp/index.js

28 B
680 B

7ms
7ms

Script
application/javascript

2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: pMndXb._rKnNP7AlILjElJlar3tWew_9
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: A1DD5E192C5056C6
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 28
x-amz-id-2: RjgsKWKjHFgd+vjTJ3hj/WZEY0Hix+0WkhftMMoTW35f0rFgogv1yf7/11/79wf75PE4cCftyiY=
Last-Modified: Mon, 21 Oct 2019 17:10:12 GMT
Server: AmazonS3
Date: Mon, 21 Oct 2019 18:23:54 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Mon, 21 Oct 2019 18:23:54 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H2 200 P6EQKMLZI5FIFB3TRJ7KKP Show response
d.adroll.com/consent/check/ 72 B
389 B 98ms
30ms Script
application/javascript 54.154.133.226
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/P6EQKMLZI5FIFB3TRJ7KKP?_s=50f395a42057c9bf2b913a27b6d0f806&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.133.226 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-154-133-226.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 6d6b324869fb23ffc0ebd3503f78cd83981d84833e2d9ec2bd43b9b9a1d94373

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:54 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: application/javascript
content-length: 72

GET
H/1.1

200
OK

MXYH5RBOOVG7XIRYWEYUBK.js Show response
s.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM/
Redirect Chain

https://d.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&pv=98838348939.4149&cookie=&adroll_s_ref=&keyw=&arrfrr=ht...
https://s.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM/MXYH5RBOOVG7XIRYWEYUBK.js

3 KB
2 KB

21ms
10ms

Script
text/javascript

2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM/MXYH5RBOOVG7XIRYWEYUBK.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 0b2bdc1a4edcd8cda7f48bebf63455a9f257ce5742bd02304c02f60b5d83d5aa

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: HJM0W3sHdqOxtGliPj.JO0IaYFdxXaV0
Content-Encoding: gzip
ETag: "52b17a0dfb06dfa209f6e0612e42381d"
x-amz-request-id: ECF6FC7BB95F0E67
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1292
x-amz-id-2: 4zqL8eQ53EJpjhw+euDHeuIfZ8Ql9udEIGHRsx+bMAtjAHotqPrYh4B11736aO3xIIeY/LMXqzc=
Last-Modified: Thu, 10 Oct 2019 20:53:42 GMT
Server: AmazonS3
Date: Mon, 21 Oct 2019 18:23:54 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

date: Mon, 21 Oct 2019 18:23:54 GMT
x-segment-display-name
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 302
content-length: 0
pragma: no-cache
x-conversion-value: 0.0
server: nginx/1.16.1
x-rule: *
x-segment-eid: MXYH5RBOOVG7XIRYWEYUBK
location: https://s.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM/MXYH5RBOOVG7XIRYWEYUBK.js
cache-control: no-store, no-cache, must-revalidate
x-pixel-eid: OQKWWSDGM5DB5EKVORPPSM
x-segment-name: *
x-advertisable-eid: P6EQKMLZI5FIFB3TRJ7KKP
x-conversion-currency

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 103 KB
22 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: s.adroll.com
URL: https://s.adroll.com/pixel/P6EQKMLZI5FIFB3TRJ7KKP/OQKWWSDGM5DB5EKVORPPSM/MXYH5RBOOVG7XIRYWEYUBK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

9404cee30e4489a7ed4d6de2dd92aa8e4386fd5ff1c81ebcea77f581952eac31

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
content-length: 22458
x-xss-protection: 0
pragma: public
x-fb-debug: unzZiLE51kt32NL0CNvLl9ZST7uopqugPeZEmDXavE/p+YP6qXv+GlGyl0YX5zzWa1SZ6Upk0lqx9H3BcP6w+A==
x-fb-trip-id: 1850256238
x-frame-options: DENY
date: Mon, 21 Oct 2019 18:23:54 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

in
d.adroll.com/cm/r/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

42 B
360 B

30ms
30ms

Image
image/gif

54.154.133.226
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.133.226 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-154-133-226.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:54 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42

Redirect headers

Date: Mon, 21 Oct 2019 18:23:54 GMT
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
P3P: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Location: https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H2

200

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP
https://x.bidswitch.net/sync?dsp_id=44&user_id=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM

43 B
378 B

24ms
24ms

Image
image/gif

52.57.35.19
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.35.19 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-57-35-19.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Mon, 21 Oct 2019 18:23:54 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

status: 302
date: Mon, 21 Oct 2019 18:23:54 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

setuid
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP
https://ib.adnxs.com/setuid?entity=172&code=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM

43 B
875 B

50ms
36ms

Image
image/gif

37.252.173.22
AppNexus

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=172&code=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 21 Oct 2019 18:23:56 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.253:80
AN-X-Request-Uuid: 13bd9ef6-146a-4e1b-b694-d5a2f97f8382
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:54 GMT
server: nginx/1.16.1
status: 302
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://ib.adnxs.com/setuid?entity=172&code=MGYzMGRmZTAwMDYxMzcxMjdhZTljYTg0YzMxNzVjODM
cache-control: no-store, no-cache, must-revalidate
content-length: 93

GET
H2

204

377928.gif
idsync.rlcdn.com/
Redirect Chain

https://d.adroll.com/cm/l/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP
https://idsync.rlcdn.com/377928.gif?partner_uid=0f30dfe0006137127ae9ca84c3175c83

0
40 B

113ms
113ms

Image
text/plain

35.190.72.21
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/377928.gif?partner_uid=0f30dfe0006137127ae9ca84c3175c83
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 21.72.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Mon, 21 Oct 2019 18:23:54 GMT
via: 1.1 google
alt-svc: clear

Redirect headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:54 GMT
server: nginx/1.16.1
status: 302
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://idsync.rlcdn.com/377928.gif?partner_uid=0f30dfe0006137127ae9ca84c3175c83
cache-control: no-store, no-cache, must-revalidate
content-length: 86

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP
https://us-u.openx.net/w/1.0/sd?id=537103138&val=0f30dfe0006137127ae9ca84c3175c83
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0f30dfe0006137127ae9ca84c3175c83

43 B
109 B

16ms
16ms

Image
image/gif

34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0f30dfe0006137127ae9ca84c3175c83
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.164.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:54 GMT
via: 1.1 google
server: OXGW/16.164.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 21 Oct 2019 18:23:54 GMT
via: 1.1 google
server: OXGW/16.164.0
status: 302
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=0f30dfe0006137127ae9ca84c3175c83
alt-svc: clear
content-length: 0

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=bda05f0cbb1e595acb46c18da710d868-1571682234218&xid_ch=f&advertisable=P6EQKMLZI5FIFB3TRJ7KKP&google_nid=adroll5
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=DzDf4ABhNxJ66cqEwxdcgw
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=DzDf4ABhNxJ66cqEwxdcgw&google_tc=
https://d.adroll.com/cm/g/in

42 B
377 B

30ms
29ms

Image
image/gif

54.154.133.226
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.133.226 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-154-133-226.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:54 GMT
server: nginx/1.16.1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
status: 200
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Mon, 21 Oct 2019 18:23:54 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://d.adroll.com/cm/g/in
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 2666261986717143 Show response
connect.facebook.net/signals/config/ 280 KB
65 KB 114ms
114ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2666261986717143?v=2.9.5&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

77a07531d5038e1877a89ae6253251012ff93007339a005818a44178a741b093

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: d+2ofQiofeGHJYtoOERZZ1WlmIGfelAJIc8g1VQBwtC0rlz1Oa8nXS5cLdJ5gK5gUCiIRqDOO8WWBa/cGcL91A==
x-fb-trip-id: 1850256238
x-frame-options: DENY
date: Mon, 21 Oct 2019 18:23:54 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
246 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2666261986717143&ev=PageView&dl=https%3A%2F%2Fheimdalsecurity.com%2Fblog%2Fscam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize%2F&rl=&if=false&ts=1571682234448&cd[segment_eid]=MXYH5RBOOVG7XIRYWEYUBK&sw=1600&sh=1200&v=2.9.5&r=stable&ec=0&o=29&fbp=fb.1.1571682234447.1138759756&it=1571682234316&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://heimdalsecurity.com/blog/scam-alert-digi-phishing-campaign-detected-asking-credentials-for-a-prize/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 21 Oct 2019 18:23:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-23=":443"; ma=3600
content-length: 44
expires: Mon, 21 Oct 2019 18:23:54 GMT

Verdicts & Comments Add Verdict or Comment

191 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.heimdalsecurity.com/	1970-01-19 13:07:20	Name: _hjid Value: 17bae983-9863-4e46-bc8b-9c0a2d373038
.heimdalsecurity.com/	1970-01-19 04:36:08	Name: _gid Value: GA1.2.1146576206.1571682234
.heimdalsecurity.com/	1970-01-19 04:34:42	Name: _gat Value: 1
.heimdalsecurity.com/	1970-01-19 22:05:54	Name: _ga Value: GA1.2.1643920230.1571682234

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.yahoo.com
chimpstatic.com
clientcdn.pushengage.com
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
fonts.googleapis.com
fonts.gstatic.com
heimdalsecurity.com
ib.adnxs.com
idsync.rlcdn.com
pages.heimdalsecurity.com
s.adroll.com
script.hotjar.com
secure.gravatar.com
static.hotjar.com
stats.g.doubleclick.net
us-u.openx.net
vars.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
x.bidswitch.net
13.224.196.44
13.69.85.94
147.75.33.59
147.75.84.117
147.75.84.99
172.217.16.194
2.18.233.40
23.45.111.171
2a00:1288:110:c305::9000
2a00:1450:4001:815::200e
2a00:1450:4001:816::2003
2a00:1450:4001:819::2003
2a00:1450:4001:81a::2008
2a00:1450:4001:81d::2004
2a00:1450:4001:821::200a
2a00:1450:400c:c00::9c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
34.95.120.147
35.190.72.21
37.252.173.22
52.157.161.254
52.57.35.19
54.154.133.226
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531
08934174e55fa6aeb2ade3dced4674586ed79ba37aa917f7bd5028cd6b35d1f9
093f793b6c3610bba76c878b4a0a1ec692d30afbc71aa239816ee16e88b7e8b7
0b2bdc1a4edcd8cda7f48bebf63455a9f257ce5742bd02304c02f60b5d83d5aa
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11b7448c22b34dae17fdace8778630f6e9bab3e826c1a1ca960284359ab453b0
15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a
15d9b210b1042e0e83d5e90de78984dbed52d5fe53085e8a5867a32cc758962c
1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30
1cc5b433a54bd6b44fed0070918d184416033b19325d2359f114944af961e7f5
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed
2490f71eb2731918773ffee635684f71d90191687cec90809c837a6787af8eb1
252ba0587b0a24f354c1cca69a67dbe190ed3cb49b530b60d652f7b8887d29d1
2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a
2ac03a4c7aff60dbd686171c3bb784e852d75a0449720e7885d533b612a72dc8
2d5cb833f7c6f72d7bf4f116c1d09d3132fe8aa4aa7acc4ab7b8a6961bdad1e2
347397795aa18445b8861779c68d70b2fc592b4aebf7941aa6b7a9aef06c5375
3be0a916496d7936bb83ce60a4de9f10ef400f16c38e7dd7c65449c795e7739b
4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775
458a280b395d136f1e67b67b93aeebb0fcd75b8783a489e0c3a5989453a3cea4
45d943e6064d6c659c986279b288a37572ce41d8fa322feae4f70b846570af3d
4901c9453014d8e210b2f62189f68c2d7964543517e1fc8447924de7d542058a
4ac8c13b27d96ddfce0b1548ceb1c8ae3de7d1a5c773a50dbafcae943fd22aeb
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b676cf8499ae3f9408d905a3e6b8cde4a25cb165411639a5da2a9c6aa9295fd
4bd45343c9962891995b13160bc4860a2d7a23d003b28c14582b5217e07e3b8c
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5595963bca2af38bc8e44b3447f2fbe26d3d552b151e0d2cba04530609cf6676
5a4a9f4076fc96fb244f92a12a017c93917f5d7c14f91c398faf43f6b634b1ea
5b52b65dc4402a3e86ad166b8547ddc3602440b3621c87e692a1f464c3a0e20e
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c
60e65a3d4adf666063047c8bd405a731c68a83b5de8d4f892c06fa357a26a7c0
6d6b324869fb23ffc0ebd3503f78cd83981d84833e2d9ec2bd43b9b9a1d94373
6dca8a37c1b0cb65330af9a470df0563a1fc6bc02bf379f07c0101c15fcf85b5
707a3f9a6fc5e63cd997c2e751a08e36caf4441e65b351b86c5de65fd832f063
7233427f6810a2e739af4c73fec0933ea969f9f81a46c9060b888e7f6910f54e
760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635
77a07531d5038e1877a89ae6253251012ff93007339a005818a44178a741b093
7836abd3871f857f1d6c2e1354979afca303a088dd80670ebb9829b0262ec170
799afe05fe88dbb1d4ca9367635c10122fb4ae9f3143d4e1756547a60d55486d
7bc15c522a05ce0e56b8cb3fff83bc6e770130afdd840d469869db69663d78fe
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
7f36de4455b10ca52ae3e585dc4cafd63851715da1ae3e4b2439f66ac045ebfd
7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2
831866373d9de6a09a1c407503c26cd7ade7ac2cccf520ff84ddd7c3b0ca8b1c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
880a2e81641380a4609a464aa6c813ba5a47f953ea354c1f08eb4f0706409ccd
8f98d1e3eefb7d26d9a1fbe17b046769afb0335b4dccd5a0861fc77d7833db70
90f944f98912737cd582f7fadf149e9d2d064adc8fdf6f0621ba0a20dd68493a
92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc
9404cee30e4489a7ed4d6de2dd92aa8e4386fd5ff1c81ebcea77f581952eac31
9ab534712eaaadb46bded7f13f60337ce4ad05476f07328f1670d9cfcfbc2e70
9c073fdceba86c6fa3561b67d66f87c7d2e36ace8f1ec539b5305985c0773813
a2953e22f7b3afac6b55791bd52cd4c349d27035b1f6fddab86c585b271bdf60
a7260c89998dba51ffa677ea4292848fa9a3d364b013cb5ed5808976b42e02ec
ae79ef8a171c02a3c7de6d2bb6a5f6a5c2fd165fe719d2b68242c4017fa9705d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b46e09f6c0ee1ed65eade148280444edd210e54034a0c20f8e586b44e8267315
b7f9aeeefcefcda53d79b74210384708eb96c604bb336ee4d4e41f58c63fe0de
ba089dc1a67eec11482dc4b2c9322dc2abe7d00fd7a721593ff901a4dc879297
ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d
bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f
bd8e8ced8db041de50ad0bc10dfeddbcc895707d642512b85afb3e906bac5e10
c68d891f07355e5d0807b4a4f18ac8f16f6e9088277be3134c7efa570022ab2d
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d62a97f322d23ea7d63f7e75b56bf3df563a2c71d08c3ef9a86fab9dffcc308b
d6f19a46db129c5750b9d448c369b7910e9c3980d6ac72b683782f269070a5cf
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dbf1552257dbdff9b53c6f3b5ba8aa1092ded30ed72b30513e6ff197a43f9b55
de9f3ac6d172868eefdccdf3661c43fb5634d5a0154a520611735639f77fb451
e1a7d4a226bbfff132032088b8da0daaa0dba4e5a9da23da71a582fec0e58def
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e58c39ba17562db2e291a8ba0bc7c81a689f3bc4993b9597805ac8ef996c220c
e8c924341999bd9f3dbe1535ce57672bcb71bfdcd338af43723de11eddb3f927
ed6a7cfa5e338448b1f64bbfde7355e5b372adb484d943f736c0b14b1c4dd397
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0abd7b0fbb053a03343edcba1216667880ce4457b3d62c66bf8064b1fd2f657
f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f6e4f5edb3194334a199f0bf80b38d92a0b7388330fbce94c8c0fb2f852c171f
f8297a1a9801fb95e677acca571b01829c8ffa5a74b91c355b5416bbc15643a0
faa6cd619c2cc2d1741d4c2018a1988eb291a803c7d3a7b5bddc3df6584999f8
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

heimdalsecurity.com Open in urlscan Pro 52.157.161.254 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

90 Requests

100 %HTTPS

44 %IPv6

20 Domains

25 Subdomains

22 IPs

7 Countries

1384 kBTransfer

2981 kBSize

4 Cookies

9 Outgoing links

Page URL History

Redirected requests

90 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

heimdalsecurity.com Open in urlscan Pro
52.157.161.254 Public Scan

Screenshot
Live screenshot

Full Image

90
Requests

100 %
HTTPS

44 %
IPv6

20
Domains

25
Subdomains

22
IPs

7
Countries

1384 kB
Transfer

2981 kB
Size

4
Cookies

90 HTTP transactions
1 data transactions