email-bofa-promo.webcindario.com Open in urlscan Pro
5.57.226.202 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a98...
Submission: On April 20 via automatic, source openphish (April 20th 2019, 12:40:41 am UTC)

Summary HTTP 69 Redirects Behaviour Indicators

Summary

This website contacted 27 IPs in 7 countries across 34 domains to perform 69 HTTP transactions. The main IP is 5.57.226.202, located in Madrid, Spain and belongs to SERVIHOSTING-AS AireNetworks - StackScale, ES. The main domain is email-bofa-promo.webcindario.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 15th 2019. Valid for: 3 months.

This is the only time email-bofa-promo.webcindario.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address	AS Autonomous System
5	5.57.226.202 5.57.226.202	29119 (SERVIHOST...) (SERVIHOSTING-AS AireNetworks - StackScale)
4	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
2	3.17.116.255 3.17.116.255	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	51.68.180.203 51.68.180.203	16276 (OVH) (OVH)
1	2606:4700:20:... 2606:4700:20::6819:ce08	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:814::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:821::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
3	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1 2	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	2a00:1450:400... 2a00:1450:4001:81e::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81f::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
3	146.20.129.102 146.20.129.102	27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
5	146.20.129.1 146.20.129.1	27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
1	185.103.39.29 185.103.39.29	29119 (SERVIHOST...) (SERVIHOSTING-AS AireNetworks - StackScale)
1	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1	146.20.129.187 146.20.129.187	27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
5	146.20.128.132 146.20.128.132	27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
1	52.202.121.118 52.202.121.118	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 3	63.32.138.7 63.32.138.7	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	54.209.157.57 54.209.157.57	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
5	146.20.129.23 146.20.129.23	27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
1 1	63.32.166.115 63.32.166.115	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	104.111.241.32 104.111.241.32	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	34.247.108.7 34.247.108.7	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY - Fastly)
1 1	151.101.0.166 151.101.0.166	54113 (FASTLY) (FASTLY - Fastly)
1 1	116.202.39.4 116.202.39.4	24940 (HETZNER-AS) (HETZNER-AS)
1	146.20.129.32 146.20.129.32	27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting)
1	52.22.180.243 52.22.180.243	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	172.217.23.130 172.217.23.130	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	67.226.210.14 67.226.210.14	395486 (TREMOR-VIDEO) (TREMOR-VIDEO - Tremor Video DSP)
2 2	185.64.189.216 185.64.189.216	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
1 1	216.58.205.226 216.58.205.226	15169 (GOOGLE) (GOOGLE - Google LLC)
2	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
2 2	34.246.249.223 34.246.249.223	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
69	27

5 5.57.226.202 (Madrid, Spain)

ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES)

email-bofa-promo.webcindario.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81d::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.17.116.255 (Fairfield, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-17-116-255.us-east-2.compute.amazonaws.com

ads.vidoomy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.68.180.203 (United Kingdom)

ASN16276 (OVH, FR)
PTR: ns3125521.ip-51-68-180.eu

static.addevweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::6819:ce08 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

hosting.miarroba.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:815::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: map2.hwcdn.net

ad.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::200e (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9a (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2004 (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 146.20.129.102 (San Antonio, United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)

v.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 146.20.129.1 (San Antonio, United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)

t.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.103.39.29 (Netherlands)

ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES)

static.sunmedia.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: map2.hwcdn.net

ad.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.20.129.187 (San Antonio, United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)

v.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 146.20.128.132 (San Antonio, United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)

t.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.202.121.118 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-202-121-118.compute-1.amazonaws.com

rtb.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.32.138.7 (United States) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-63-32-138-7.eu-west-1.compute.amazonaws.com

sync.tidaltv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.209.157.57 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-209-157-57.compute-1.amazonaws.com

media.sabio.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 146.20.129.23 (San Antonio, United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)

cs.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.32.166.115 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-63-32-166-115.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.241.32 (Amsterdam, Netherlands) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-241-32.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.247.108.7 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-247-108-7.eu-west-1.compute.amazonaws.com

sync.tidaltv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.49 (San Francisco, United States) 1 redirects

ASN54113 (FASTLY - Fastly, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.0.166 (San Francisco, United States) 1 redirects

ASN54113 (FASTLY - Fastly, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 116.202.39.4 (India) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.4.39.202.116.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.20.129.32 (San Antonio, United States)

ASN27357 (RACKSPACE - Rackspace Hosting, US)

cs.lkqd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.180.243 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-22-180-243.compute-1.amazonaws.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.130 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s18-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.226.210.14 (United States) 1 redirects

ASN395486 (TREMOR-VIDEO - Tremor Video DSP, Inc, US)
PTR: nginx14.iad1.videohub.tv

dt-secure.videohub.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.216 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

image8.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.205.226 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.246.249.223 (United States) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-246-249-223.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.233.180 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

vpaid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	lkqd.net ad.lkqd.net v.lkqd.net t.lkqd.net cs.lkqd.net	201 KB
5	pubmatic.com 2 redirects image8.pubmatic.com image2.pubmatic.com vpaid.pubmatic.com	4 KB
5	doubleclick.net 3 redirects googleads.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net	808 B
5	webcindario.com email-bofa-promo.webcindario.com	122 KB
4	tidaltv.com 2 redirects sync.tidaltv.com	2 KB
4	googlesyndication.com pagead2.googlesyndication.com	185 KB
2	adsrvr.org 2 redirects match.adsrvr.org	1 KB
2	google-analytics.com 1 redirects www.google-analytics.com	17 KB
2	google.com 1 redirects adservice.google.com www.google.com	349 B
2	google.de adservice.google.de www.google.de	280 B
2	vidoomy.com ads.vidoomy.com	4 KB
1	videohub.tv 1 redirects dt-secure.videohub.tv	504 B
1	rlcdn.com idsync.rlcdn.com	34 B
1	loopme.me 1 redirects csync.loopme.me	356 B
1	contextweb.com 1 redirects bh.contextweb.com	577 B
1	everesttech.net 1 redirects sync-tm.everesttech.net	187 B
1	demdex.net 1 redirects dpm.demdex.net	408 B
1	sabio.us 1 redirects media.sabio.us	218 B
1	bluekai.com stags.bluekai.com Failed tags.bluekai.com	770 B
1	adentifi.com rtb.adentifi.com	88 B
1	sunmedia.tv static.sunmedia.tv Failed	5 KB
1	googletagservices.com www.googletagservices.com	28 KB
1	googletagmanager.com www.googletagmanager.com	18 KB
1	miarroba.info hosting.miarroba.info	201 B
1	addevweb.com static.addevweb.com	39 KB
0	truoptik.com Failed dmp.truoptik.com Failed
0	mathtag.com Failed sync.mathtag.com Failed
0	quantserve.com Failed cms.quantserve.com Failed
0	turn.com Failed ad.turn.com Failed
0	brealtime.com Failed cookie.brealtime.com Failed
0	eyeviewads.com Failed track.eyeviewads.com Failed
0	krxd.net Failed beacon.krxd.net Failed
0	dyntrk.com Failed gu.dyntrk.com Failed
0	bidswitch.net Failed x.bidswitch.net Failed
69	34

	Domain	Requested by
10	t.lkqd.net	ad.lkqd.net email-bofa-promo.webcindario.com
6	cs.lkqd.net
5	email-bofa-promo.webcindario.com	email-bofa-promo.webcindario.com
4	sync.tidaltv.com	2 redirects
4	v.lkqd.net	ad.lkqd.net
4	ad.lkqd.net	ads.vidoomy.com ad.lkqd.net
4	pagead2.googlesyndication.com	email-bofa-promo.webcindario.com pagead2.googlesyndication.com
2	match.adsrvr.org	2 redirects
2	image2.pubmatic.com
2	image8.pubmatic.com	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	www.google-analytics.com	1 redirects www.googletagmanager.com
2	ads.vidoomy.com	email-bofa-promo.webcindario.com
1	vpaid.pubmatic.com	ad.lkqd.net
1	dt-secure.videohub.tv	1 redirects
1	idsync.rlcdn.com
1	csync.loopme.me	1 redirects
1	bh.contextweb.com	1 redirects
1	sync-tm.everesttech.net	1 redirects
1	tags.bluekai.com	1 redirects
1	dpm.demdex.net	1 redirects
1	media.sabio.us	1 redirects
1	rtb.adentifi.com
1	static.sunmedia.tv	static.addevweb.com
1	www.google.de	email-bofa-promo.webcindario.com
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	www.googletagmanager.com	email-bofa-promo.webcindario.com
1	hosting.miarroba.info	email-bofa-promo.webcindario.com
1	static.addevweb.com	email-bofa-promo.webcindario.com
0	dmp.truoptik.com Failed
0	sync.mathtag.com Failed
0	cms.quantserve.com Failed
0	ad.turn.com Failed
0	cookie.brealtime.com Failed
0	track.eyeviewads.com Failed
0	beacon.krxd.net Failed
0	stags.bluekai.com Failed
0	gu.dyntrk.com Failed
0	x.bidswitch.net Failed
69	44

This site contains no links.

Subject Issuer	Validity	Valid
webcindario.com Let's Encrypt Authority X3	`2019-04-15` - `2019-07-14`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G3	`2019-03-26` - `2019-06-18`	3 months	crt.sh
*.vidoomy.com Don Dominio / MrDomain RSA DV CA	`2018-10-18` - `2019-10-18`	a year	crt.sh
*.addevweb.com COMODO RSA Domain Validation Secure Server CA	`2017-09-11` - `2019-09-11`	2 years	crt.sh
ssl391079.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-13` - `2019-09-19`	6 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-03-26` - `2019-06-18`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-03-26` - `2019-06-18`	3 months	crt.sh
*.lkqd.net Go Daddy Secure Certificate Authority - G2	`2016-05-31` - `2019-07-12`	3 years	crt.sh
www.google.de Google Internet Authority G3	`2019-03-26` - `2019-06-18`	3 months	crt.sh
*.sunmedia.tv COMODO RSA Domain Validation Secure Server CA	`2018-01-19` - `2021-01-18`	3 years	crt.sh
*.adentifi.com Go Daddy Secure Certificate Authority - G2	`2016-10-31` - `2019-10-31`	3 years	crt.sh
*.tidaltv.com Go Daddy Secure Certificate Authority - G2	`2017-07-11` - `2020-07-11`	3 years	crt.sh
*.rlcdn.com Go Daddy Secure Certificate Authority - G2	`2017-05-08` - `2019-06-21`	2 years	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2018-12-13` - `2020-03-13`	a year	crt.sh

This page contains 11 frames:

Primary Page: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Frame ID: 3F95029A16050A2A25503671646DA2C4
Requests: 26 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190417/r20190131/show_ads_impl.js
Frame ID: A3E2E66EB3BE1C6D740A07DF9332A77B
Requests: 1 HTTP requests in this frame

Frame: https://ad.lkqd.net/vpaid/formats.js?pid=430&sid=642145
Frame ID: D99E1AE480089447925E8881BACD88B5
Requests: 2 HTTP requests in this frame

Frame: https://ad.lkqd.net/vpaid/formats.js
Frame ID: C8BE5CD571D1D97DB138717AC9528B90
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190417/r20190131/zrt_lookup.html
Frame ID: 7B6BC5108B56B2FF182DD06D8E645B31
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1555720823&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1555720823254&bpp=245&bdt=58&fdt=247&idt=179&shv=r20190417&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=7453267928392&frm=20&pv=2&ga_vid=2028115426.1555720824&ga_sid=1555720824&ga_hid=1648755076&ga_fc=0&iag=0&icsg=535040&dssz=13&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1185&scr_x=0&scr_y=0&eid=20040081%2C21060853%2C21063245%2C21061795&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&ppjl=u&fu=1040&bc=15&osw_key=817753938&ifi=0&uci=0.syrilzdyjmrs&fsb=1&dtd=309
Frame ID: 6C3DD20F3F3B0458F2ABFA9C8A586FA6
Requests: 1 HTTP requests in this frame

Frame: https://t.lkqd.net/t
Frame ID: 885FE02F69B8F2E18893A2ED6E77166F
Requests: 2 HTTP requests in this frame

Frame: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Frame ID: EFEA26D32A94D5D13FB613131AAE729D
Requests: 29 HTTP requests in this frame

Frame: https://t.lkqd.net/t
Frame ID: 0A4C0466CB5316FF653FB5B8CF97636A
Requests: 2 HTTP requests in this frame

Frame: https://t.lkqd.net/t
Frame ID: 1FA92C19EEA48B3F546196B46F659973
Requests: 6 HTTP requests in this frame

Frame: https://vpaid.pubmatic.com/ads/video/PMAdMgr.js?adtype=13&pubId=156498&siteId=399115&adId=1801592&vadFmt=2&vapi=2&vminl=1&vmaxl=181&vh=225&vw=400&placement=1&vtype=1&vpos=1&vplay=2&vskip=0&vcom=0&vfmt=1+3+5+6+7+9+11&sec=1&gdpr=&gdpr_consent=&kadpageurl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8
Frame ID: 35D936ADCDC58B8DD25DB5F6D4920760
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i
env /^google_ad_/i
env /^__google_ad_/i
env /^Goog_AdSense_/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
env /^google_tag_manager$/i

Page Statistics

69
Requests

72 %
HTTPS

26 %
IPv6

34
Domains

44
Subdomains

27
IPs

7
Countries

624 kB
Transfer

1611 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1648755076&t=pageview&_s=1&dl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&ul=en-us&de=UTF-8&dt=%CE%92%D0%B0nk%20%D0%BEf%20%CE%91m%D0%B5r%D1%96%D1%81%D0%B0%20%7C%20%CE%9Fnl%D1%96n%D0%B5%20%CE%92%D0%B0nk%D1%96ng%20%7C%20%D0%85%D1%96gn%20%CE%99n%20%7C%20Sitekey&sd=24-bit&sr=1600x1200&vp=1585x1185&je=0&_u=YAhAAAABC~&jid=287837133&gjid=197184669&cid=2028115426.1555720824&tid=UA-597118-7&_gid=1422450699.1555720824&_r=1&gtm=2wg430T2VG59&z=65354690 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_gid=1422450699.1555720824&gjid=197184669&_v=j73&z=65354690 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_v=j73&z=65354690 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_v=j73&z=65354690&slf_rd=1&random=2819560796

Request Chain 40

https://gu.dyntrk.com/adx/lkqd/us.php?dynk=l1k4q1d4&gdpr=&gdpr_consent= HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6960&udat=&img=0&redir=https%3A%2F%2Fgu.dyntrk.com%2Fadx%2Flkqd%2Fus.php%3Fb64%3DZHluaz1sMWs0cTFkNCZnZHByPSZnZHByX2NvbnNlbnQ9%26spotx_call%3D1%26kwn%3D0%26spotx_uid%3D%24SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6960&udat=&img=0&redir=https%3A%2F%2Fgu.dyntrk.com%2Fadx%2Flkqd%2Fus.php%3Fb64%3DZHluaz1sMWs0cTFkNCZnZHByPSZnZHByX2NvbnNlbnQ9%26spotx_call%3D1%26kwn%3D0%26spotx_uid%3D%24SPOTX_USER_ID&__user_check__=1&sync_id=e821ab68-6304-11e9-9d19-174deb1e0d06 HTTP 302
https://gu.dyntrk.com/adx/lkqd/us.php?b64=ZHluaz1sMWs0cTFkNCZnZHByPSZnZHByX2NvbnNlbnQ9&spotx_call=1&kwn=0&spotx_uid=e821ab07-6304-11e9-9d19-174deb1e0d06

Request Chain 42

https://media.sabio.us/imp_pixel?invsrc=11&secure=1 HTTP 302
https://cs.lkqd.net/cs?partnerId=39&partnerUserId=5579916804131786966

Request Chain 45

https://sync.tidaltv.com/genericusersync.ashx?dpid=lkqd HTTP 302
https://dpm.demdex.net/ibs:dpid=445&dpuuid=25157a45-f80c-42f2-9648-8138351e9017?redir=https%3A%2F%2Fsync.tidaltv.com%2Fgenericusersync.ashx%3Fdpid%3D1262&gdpr=1&gdpr_consent= HTTP 302
https://sync.tidaltv.com/genericusersync.ashx?dpid=1262 HTTP 302
https://tags.bluekai.com/site/5379?id=25157a45-f80c-42f2-9648-8138351e9017&redir=https%3A%2F%2Fsync.tidaltv.com%2Fgenericusersync.ashx%3Fdpid%3D1263&gdpr=1&gdpr_consent= HTTP 302
https://sync.tidaltv.com/genericusersync.ashx?dpid=1263

Request Chain 46

https://us-u.openx.net/w/1.0/cm?id=c09b4c7a-cf51-4f9d-988d-8b1b5956bd03&r=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D51%26partnerUserId%3D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=c09b4c7a-cf51-4f9d-988d-8b1b5956bd03&r=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D51%26partnerUserId%3D HTTP 302
https://cs.lkqd.net/cs?partnerId=51&partnerUserId=4a04bddc-81d3-433c-92a9-2ca5674db755

Request Chain 47

https://sync-tm.everesttech.net/upi/pid/aUTuBPNf?redir=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D52%26partnerUserId%3D%24%7BUSER_ID%7D HTTP 302
https://cs.lkqd.net/cs?partnerId=52&partnerUserId=XLpqeAAAAEIeSQFr

Request Chain 48

https://bh.contextweb.com/bh/rtset?pid=561322&ev=1&rurl=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D53%26partnerUserId%3D%25%25VGUID%25%25 HTTP 302
https://cs.lkqd.net/cs?partnerId=53&partnerUserId=o7bTOHA38kSO&ev=1&pid=561322

Request Chain 49

https://csync.loopme.me/?redirect=http%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D54%26partnerUserId%3D%7Bdevice_id%7D HTTP 307
http://cs.lkqd.net/cs?partnerId=54&partnerUserId=23dadbee-ebda-4d5d-86d4-3a4134d80fb8

Request Chain 52

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm&google_sc HTTP 302
https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEBhBVEhZWrsOgZbdlX2bWDg&google_cver=1

Request Chain 54

https://dt-secure.videohub.tv/v1/tpsync/lkqd_direct HTTP 303
https://cs.lkqd.net/cs?partnerId=61&partnerUserId=aaffbb5a227821825fbae96863f19d24

Request Chain 55

https://image8.pubmatic.com/AdServer/ImgSync?p=156759&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156759%26pr%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D63%2526partnerUserId%253D%2523PMUID HTTP 302
http://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc HTTP 302
http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&piggybackCookie=CAESEKS05Ly9IfxeQ6K1FZmnTi8&google_cver=1

Request Chain 56

https://image8.pubmatic.com/AdServer/ImgSync?p=156759&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156759%26pr%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D69%2526partnerUserId%253D%2523PMUID HTTP 302
http://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=

Request Chain 57

https://image8.pubmatic.com/AdServer/ImgSync?p=156759&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156759%26pr%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D70%2526partnerUserId%253D%2523PMUID HTTP 302
http://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
http://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9d296baf-96f5-437b-b523-ad4a54ac3046

Request Chain 58

https://x.mdhv.io/lq?4xvfuQ9MXgc HTTP 307
https://cs.lkqd.net/cs?partnerId=74&partnerUserId=T5E5XT_eRy21Q7DvedLH4g

69 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request challengevdl.php Show response
email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/ 15 KB
3 KB 115ms
77ms Document
text/html 5.57.226.202
StackScale

General

Check archive.org

Show headers Download Go to

Full URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: eb8a566141815a86f0f3869a7144cc182b83c0933f96c3b31d2c4f7141d398a7

Request headers

:method: GET
:authority: email-bofa-promo.webcindario.com
:scheme: https
:path: /bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
server: nginx
date: Sat, 20 Apr 2019 00:40:23 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
set-cookie: __muid=62a201154c8f0034f051ae05db22496ab0cc1d15; Domain=.webcindario.com; Path=/; Expires=Tue, 19 Jan 2038 03:14:11 GMT; HttpOnly PHPSESSID=61404557055904866b06f9ddaf3eb43c; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-powered-by: Webcindario Hosting Service
content-encoding: gzip

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 86 KB
32 KB 20ms
18ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

e5c3cc4737389ccda70f782d1d63683a2f0bda244edd13d6a5ab3684ce44e5ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 32763
x-xss-protection: 0
server: cafe
etag: 6830608836913287788
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 20 Apr 2019 00:40:23 GMT

GET
H2 200 style1.css
email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/ 3 KB
1 KB 42ms
40ms Stylesheet
text/css 5.57.226.202
StackScale

General

Check archive.org

Show headers Download Go to

Full URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/style1.css
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 94f243198ac37ef309f89bf03a8faf0c93c1c5a45a39f46c1ca7491306b0ac68

Request headers

:path: /bankofamerica/b67ae54e/images/style1.css
pragma: no-cache
cookie: __muid=62a201154c8f0034f051ae05db22496ab0cc1d15; PHPSESSID=61404557055904866b06f9ddaf3eb43c
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: email-bofa-promo.webcindario.com
referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
:scheme: https
:method: GET
Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
last-modified: Fri, 19 Apr 2019 19:31:36 GMT
server: nginx
x-powered-by: Webcindario Hosting Service
etag: W/"5cba2218-d57"
vary: Accept-Encoding
content-type: text/css
status: 200

GET
H2 200 new%20header.png
email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/ 104 KB
105 KB 42ms
40ms Image
image/png 5.57.226.202
StackScale

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/new%20header.png
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 1dbaa336651d898b99626cd80ec5f2ca9b0971429d6e0d9c20bead1322c362c7

Request headers

:path: /bankofamerica/b67ae54e/images/new%20header.png
pragma: no-cache
cookie: __muid=62a201154c8f0034f051ae05db22496ab0cc1d15; PHPSESSID=61404557055904866b06f9ddaf3eb43c
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: email-bofa-promo.webcindario.com
referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
:scheme: https
:method: GET
Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
last-modified: Fri, 19 Apr 2019 19:31:36 GMT
server: nginx
x-powered-by: Webcindario Hosting Service
etag: "5cba2218-1a18f"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 106895

GET
H2 200 confirm.png
email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/ 2 KB
2 KB 94ms
60ms Image
image/png 5.57.226.202
StackScale

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/confirm.png
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: 3bd5ac9684632300424ca98cbe5c5ee9af57d20ba97ced23899daf5ea9bd6685

Request headers

:path: /bankofamerica/b67ae54e/images/confirm.png
pragma: no-cache
cookie: __muid=62a201154c8f0034f051ae05db22496ab0cc1d15; PHPSESSID=61404557055904866b06f9ddaf3eb43c
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: email-bofa-promo.webcindario.com
referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
:scheme: https
:method: GET
Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
last-modified: Fri, 19 Apr 2019 19:31:36 GMT
server: nginx
x-powered-by: Webcindario Hosting Service
etag: "5cba2218-86a"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 2154

GET
H2 200 footer.png
email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/ 11 KB
11 KB 93ms
60ms Image
image/png 5.57.226.202
StackScale

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/images/footer.png
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 5.57.226.202 Madrid, Spain, ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES),
Reverse DNS
Software: nginx / Webcindario Hosting Service
Resource Hash: b0f184fbe0d818a5c23b5540423a251bef3290d1968df6c9c456f1887d391ec0

Request headers

:path: /bankofamerica/b67ae54e/images/footer.png
pragma: no-cache
cookie: __muid=62a201154c8f0034f051ae05db22496ab0cc1d15; PHPSESSID=61404557055904866b06f9ddaf3eb43c
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: email-bofa-promo.webcindario.com
referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
:scheme: https
:method: GET
Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
last-modified: Fri, 19 Apr 2019 19:31:36 GMT
server: nginx
x-powered-by: Webcindario Hosting Service
etag: "5cba2218-2cb1"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 11441

GET
H/1.1 200
OK miarrobamobile.js Show response
ads.vidoomy.com/ 2 KB
2 KB 122ms
120ms Script
application/javascript 3.17.116.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.vidoomy.com/miarrobamobile.js
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.17.116.255 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-17-116-255.us-east-2.compute.amazonaws.com
Software: Apache/2.4.37 (Amazon) OpenSSL/1.0.2k-fips PHP/7.0.33 / PHP/7.0.33
Resource Hash: 8723cae31a124bb3aba17b012e29bfc6360ecba1b40661077000e8a97afa0e55

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 20 Apr 2019 00:40:23 GMT
Server: Apache/2.4.37 (Amazon) OpenSSL/1.0.2k-fips PHP/7.0.33
X-Powered-By: PHP/7.0.33
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: Keep-Alive
Keep-Alive: timeout=2, max=489
Content-Length: 2006

GET
H/1.1 200
OK miarrodesktop.js Show response
ads.vidoomy.com/ 2 KB
2 KB 146ms
118ms Script
application/javascript 3.17.116.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.vidoomy.com/miarrodesktop.js
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.17.116.255 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-17-116-255.us-east-2.compute.amazonaws.com
Software: Apache/2.4.37 (Amazon) OpenSSL/1.0.2k-fips PHP/7.0.33 / PHP/7.0.33
Resource Hash: 021ece809cc629f17524c1e4de64b3a3d88960389d5b4dc052d3e82e70ff93ba

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 20 Apr 2019 00:40:23 GMT
Server: Apache/2.4.37 (Amazon) OpenSSL/1.0.2k-fips PHP/7.0.33
X-Powered-By: PHP/7.0.33
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: Keep-Alive
Keep-Alive: timeout=2, max=497
Content-Length: 1874

GET
H2 200 fd629041-9e6f-47d6-8dfb-cf82237caa89.js Show response
static.addevweb.com/integrations/fd629041-9e6f-47d6-8dfb-cf82237caa89/ 146 KB
39 KB 704ms
36ms Script
application/javascript 51.68.180.203
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://static.addevweb.com/integrations/fd629041-9e6f-47d6-8dfb-cf82237caa89/fd629041-9e6f-47d6-8dfb-cf82237caa89.js
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.68.180.203 , United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ns3125521.ip-51-68-180.eu
Software: nginx /
Resource Hash: 9c784c2a098312e5fceb4c1e17903ecb02c39b9164748e2a20bd2bf12d79d1ac

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
tp-cache: HIT
last-modified: Wed, 17 Apr 2019 11:34:14 GMT
server: nginx
age: 219941
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
content-type: application/javascript
status: 200
cache-control: max-age=0, s-maxage=2592001
access-control-allow-credentials: true
x-device: desktop
accept-ranges: bytes
content-length: 39531

GET
H2 200 / Show response
hosting.miarroba.info/ 0
201 B 163ms
129ms Script
application/javascript 2606:4700:20::6819:ce08
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://hosting.miarroba.info/?__muid=62a201154c8f0034f051ae05db22496ab0cc1d15&h=1858110&t=1555720823&k=21b64307914f2ef72acf25c696b025e8
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:ce08 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: br
content-type: application/javascript; charset=iso-8859-1
last-modified: Sat, 20 Apr 2019 00:40:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
status: 200
cache-control: no-cache
cf-ray: 4ca31109bef496dc-FRA
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 46 KB
18 KB 46ms
14ms Script
application/javascript 2a00:1450:4001:814::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:814::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

10e2cc38b5e1416293227b1eeb8a504949c68b23f8414dbdd45a07f5d3f4ed3f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: br
last-modified: Fri, 19 Apr 2019 21:22:44 GMT
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 17941
x-xss-protection: 0
expires: Sat, 20 Apr 2019 00:40:23 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=email-bofa-promo.webcindario.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 19ms
14ms Script
application/javascript 2a00:1450:4001:821::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=email-bofa-promo.webcindario.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:821::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190417/r20190131/ 205 KB
77 KB 26ms
23ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190417/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c81c2a184926f0de9792b39184045e08acca0d2a72aa59927de411d787d759ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 78248
x-xss-protection: 0
server: cafe
etag: 18145366447081761562
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 20 Apr 2019 00:40:23 GMT

GET
H2 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20190417/r20190131/ Frame A3E2 205 KB
77 KB 35ms
30ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20190417/r20190131/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c81c2a184926f0de9792b39184045e08acca0d2a72aa59927de411d787d759ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 78248
x-xss-protection: 0
server: cafe
etag: 18145366447081761562
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 20 Apr 2019 00:40:23 GMT

GET
H/1.1 200
OK formats.js Show response
ad.lkqd.net/vpaid/ Frame D99E 156 KB
48 KB 31ms
17ms Script
application/javascript 205.185.216.42
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/vpaid/formats.js?pid=430&sid=642145
Requested by: Host: ads.vidoomy.com
URL: https://ads.vidoomy.com/miarrobamobile.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: 7ed393c0873191e300cd7674d7c5d52ba57ac69092c8d101abe7849967bc3811

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 20 Apr 2019 00:40:23 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2019 18:04:54 GMT
X-HW: 1555720821.dop002.pa1.shc,1555720821.dop002.pa1.t,1555720823.cds029.pa1.c
Content-Type: application/javascript
Cache-Control: max-age=300
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 48632

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 29ms
4ms Script
text/javascript 2a00:1450:4001:81c::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T2VG59

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 4076
date: Fri, 19 Apr 2019 23:32:27 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17543
expires: Sat, 20 Apr 2019 01:32:27 GMT

GET
H/1.1 200
OK formats.js Show response
ad.lkqd.net/vpaid/ Frame C8BE 156 KB
48 KB 24ms
23ms Script
application/javascript 205.185.216.42
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/vpaid/formats.js
Requested by: Host: ads.vidoomy.com
URL: https://ads.vidoomy.com/miarrodesktop.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: 7ed393c0873191e300cd7674d7c5d52ba57ac69092c8d101abe7849967bc3811

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 20 Apr 2019 00:40:23 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2019 18:04:54 GMT
X-HW: 1555720820.dop002.pa1.shc,1555720820.dop002.pa1.t,1555720823.cds031.pa1.c
Content-Type: application/javascript
Cache-Control: max-age=300
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 48632

GET
H2 200 ca-pub-7294310421616689.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ 133 B
190 B 29ms
6ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-7294310421616689.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 12:48:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 18 Apr 2019 20:36:43 GMT
server: sffe
age: 42690
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 125
x-xss-protection: 0
expires: Sat, 20 Apr 2019 00:48:53 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190417/r20190131/ Frame 7B6B 0
0 7ms
6ms Document
text/html 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20190417/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20190417/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Wed, 17 Apr 2019 14:01:07 GMT
expires: Wed, 01 May 2019 14:01:07 GMT
content-type: text/html; charset=UTF-8
etag: 3275482936266559025
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 6909
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 211156
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"

GET
H2 403 ads
googleads.g.doubleclick.net/pagead/ Frame 6C3D 0
0 71ms
28ms Document
text/html 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1555720823&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1555720823254&bpp=245&bdt=58&fdt=247&idt=179&shv=r20190417&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=7453267928392&frm=20&pv=2&ga_vid=2028115426.1555720824&ga_sid=1555720824&ga_hid=1648755076&ga_fc=0&iag=0&icsg=535040&dssz=13&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1185&scr_x=0&scr_y=0&eid=20040081%2C21060853%2C21063245%2C21061795&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&ppjl=u&fu=1040&bc=15&osw_key=817753938&ifi=0&uci=0.syrilzdyjmrs&fsb=1&dtd=309

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190417/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:815::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-7294310421616689&output=html&adk=1812271804&adf=3025194257&lmt=1555720823&plat=1%3A32776%2C2%3A32776%2C8%3A32776%2C9%3A32776%2C16%3A8388608%2C30%3A1081344&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&ea=0&flash=0&pra=5&wgl=1&adsid=NT&dt=1555720823254&bpp=245&bdt=58&fdt=247&idt=179&shv=r20190417&cbv=r20190131&saldr=aa&abxe=1&nras=1&correlator=7453267928392&frm=20&pv=2&ga_vid=2028115426.1555720824&ga_sid=1555720824&ga_hid=1648755076&ga_fc=0&iag=0&icsg=535040&dssz=13&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=0&ady=0&biw=1585&bih=1185&scr_x=0&scr_y=0&eid=20040081%2C21060853%2C21063245%2C21061795&oid=3&rx=0&eae=2&fc=1936&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&ppjl=u&fu=1040&bc=15&osw_key=817753938&ifi=0&uci=0.syrilzdyjmrs&fsb=1&dtd=309
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8

Response headers

status: 403
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 20 Apr 2019 00:40:23 GMT
server: cafe
content-length: 46
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 20-Apr-2019 00:55:23 GMT; path=/; domain=.doubleclick.net
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 76 KB
28 KB 74ms
45ms Script
text/javascript 2a00:1450:4001:809::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190417/r20190131/show_ads_impl.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:809::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9fe96f11cd5e87cbfe3e2b73a62fe86ead3517929b425fb84ac287388a6db037

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1555672411458484"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 28613
x-xss-protection: 0
expires: Sat, 20 Apr 2019 00:40:23 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1648755076&t=pageview&_s=1&dl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-d...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_gid=1422450699.1555720824&gjid=197184669&_v=j73&z=65354690
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_v=j73&z=65354690
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_v=j73&z=65354690&slf_rd=1&random=2819560796

42 B
109 B

18ms
18ms

Image
image/gif

2a00:1450:4001:81f::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_v=j73&z=65354690&slf_rd=1&random=2819560796

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81f::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 20 Apr 2019 00:40:23 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 20 Apr 2019 00:40:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-597118-7&cid=2028115426.1555720824&jid=287837133&_v=j73&z=65354690&slf_rd=1&random=2819560796
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
v.lkqd.net/ Frame C8BE 2 KB
2 KB 93ms
90ms XHR
application/xml 146.20.129.102
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://v.lkqd.net/ad?pid=430&sid=642602&formats=true&output=vastvpaid&support=html5&execution=outstream&placement=slider&playinit=auto&volume=0&width=400&height=225&gdpr=&gdprcs=&pageurl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&dnt=0&c1=&c2=&c3=&rnd=78140271&m=
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.102 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: 2e27b804b3f6bd69586532ca796f1a4b4481e4b1e143ab6150619140993c774b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
server: nginx
status: 200
content-type: application/xml; charset=UTF-8
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 1441

GET
H2 200 ad Show response
v.lkqd.net/ Frame D99E 180 B
365 B 91ms
90ms XHR
application/xml 146.20.129.102
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://v.lkqd.net/ad?pid=430&sid=642594&formats=true&output=vastvpaid&support=html5&execution=outstream&placement=slider&playinit=auto&volume=0&width=400&height=225&gdpr=&gdprcs=&pageurl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&dnt=0&c1=&c2=&c3=&rnd=40243211&m=
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js?pid=430&sid=642145
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.102 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: 45fa735c6df15f15a1293a9cb3125033408874bf284280e8bcac23f95ad8feac

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com

Response headers

date: Sat, 20 Apr 2019 00:40:23 GMT
content-encoding: gzip
server: nginx
status: 200
content-type: application/xml; charset=UTF-8
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 150

OPTIONS
H2 200 t Show response
t.lkqd.net/ Frame 885F 0
300 B 102ms
102ms XHR
text/plain 146.20.129.1
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.1 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://email-bofa-promo.webcindario.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: https://email-bofa-promo.webcindario.com
access-control-max-age: 300
access-control-allow-methods: GET, OPTIONS, POST
content-type: text/plain; charset=UTF-8
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=300
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0

GET
H/1.1 200
OK vpaid.js Show response
ad.lkqd.net/vpaid/ Frame EFEA 310 KB
91 KB 25ms
22ms Script
application/javascript 205.185.216.42
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: 36870b7962d775ac7400b1931ae54b1e978d3495323882bb351b7b7afae46114

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 20 Apr 2019 00:40:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Mar 2019 19:34:43 GMT
X-HW: 1555720820.dop002.pa1.shc,1555720820.dop002.pa1.t,1555720823.cds031.pa1.c
Content-Type: application/javascript
Cache-Control: max-age=120
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 92894

OPTIONS
H2 200 t Show response
t.lkqd.net/ Frame 0A4C 0
300 B 111ms
100ms XHR
text/plain 146.20.129.1
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js?pid=430&sid=642145
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.1 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://email-bofa-promo.webcindario.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: https://email-bofa-promo.webcindario.com
access-control-max-age: 300
access-control-allow-methods: GET, OPTIONS, POST
content-type: text/plain; charset=UTF-8
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=300
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0

GET eu_country.php
static.sunmedia.tv/SMVpaidCreatives/geotarget/ 0
0

GET outstream.json
static.sunmedia.tv/SMSdk/tracker/ 0
0

GET
H2 200 adblockDetector.js Show response
static.sunmedia.tv/SMSdk/assets/AdBlockDetection/ 13 KB
5 KB 37ms
37ms Script
application/javascript 185.103.39.29
StackScale

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sunmedia.tv/SMSdk/assets/AdBlockDetection/adblockDetector.js
Requested by: Host: static.addevweb.com
URL: https://static.addevweb.com/integrations/fd629041-9e6f-47d6-8dfb-cf82237caa89/fd629041-9e6f-47d6-8dfb-cf82237caa89.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.103.39.29 , Netherlands, ASN29119 (SERVIHOSTING-AS AireNetworks - StackScale, ES),
Reverse DNS
Software: nginx /
Resource Hash: 4984c39b03cddab1198a70add535b4600ac615d3e938edbec8d2d8b53b9f0a60

Request headers

Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
content-encoding: gzip
tp-cache: HIT
last-modified: Fri, 05 Apr 2019 08:45:28 GMT
server: nginx
age: 998420
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=0, s-maxage=2592000
x-device: desktop
tp-l2-cache: MISS
accept-ranges: bytes
content-length: 4831

GET
H/1.1 200
OK blocking_regex Show response
ad.lkqd.net/mediafile/ Frame EFEA 2 KB
2 KB 94ms
34ms XHR
application/json 205.185.216.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/mediafile/blocking_regex
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: 72042d3923be4aed26983c927543df8fde3fe290257e4afc1215d3e6d9e8d6c2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com

Response headers

Date: Sat, 20 Apr 2019 00:40:24 GMT
Content-Encoding: gzip
Last-Modified: Sat, 20 Apr 2019 00:35:54 GMT
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
Access-Control-Allow-Methods: GET
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 0
Cache-Control: max-age=300
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1096
X-HW: 1555720824.dop002.pa1.shc,1555720824.dop002.pa1.t,1555720824.cds029.pa1.sr,1555720824.cds033.pa1.c,1555720824.cds029.pa1.e

OPTIONS
H2 200 ad Show response
v.lkqd.net/ Frame EFEA 0
279 B 102ms
100ms XHR
text/plain 146.20.129.187
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://v.lkqd.net/ad?pid=430&sid=642602&formats=true&output=json2&support=html5&execution=outstream&placement=slider&playinit=auto&volume=0&width=400&height=225&gdpr=&gdprcs=&pageurl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&dnt=0&c1=&c2=&c3=&rnd=78140271&m=&rtv=1&thost=email-bofa-promo.webcindario.com
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.187 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://email-bofa-promo.webcindario.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: https://email-bofa-promo.webcindario.com
access-control-max-age: 300
access-control-allow-methods: GET, POST, OPTIONS
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=300
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65cb5cd5882c666a22bf188d80f04fe01f56fbb3428e29d74aa24e3d9b1c783b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 t Show response
t.lkqd.net/ Frame 885F 0
175 B 95ms
93ms XHR
text/plain 146.20.128.132
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: email-bofa-promo.webcindario.com
URL: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.132 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com
Content-Type: application/json

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
status: 200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 0

POST
H2 200 t Show response
t.lkqd.net/ Frame 0A4C 0
175 B 100ms
92ms XHR
text/plain 146.20.128.132
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.132 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com
Content-Type: application/json

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
status: 200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 0

POST
H2 200 ad Show response
v.lkqd.net/ Frame EFEA 13 KB
4 KB 98ms
97ms XHR
application/json 146.20.129.102
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://v.lkqd.net/ad?pid=430&sid=642602&formats=true&output=json2&support=html5&execution=outstream&placement=slider&playinit=auto&volume=0&width=400&height=225&gdpr=&gdprcs=&pageurl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8&dnt=0&c1=&c2=&c3=&rnd=78140271&m=&rtv=1&thost=email-bofa-promo.webcindario.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.102 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: c0f538c080adde99f65d125690145594c18684094834db9acad80ed019391d14

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com
Content-Type: application/json

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
content-encoding: gzip
server: nginx
status: 200
content-type: application/json
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 3694

OPTIONS
H2 200 t Show response
t.lkqd.net/ Frame 1FA9 0
300 B 102ms
102ms XHR
text/plain 146.20.129.1
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.1 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://email-bofa-promo.webcindario.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: https://email-bofa-promo.webcindario.com
access-control-max-age: 300
access-control-allow-methods: GET, OPTIONS, POST
content-type: text/plain; charset=UTF-8
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=300
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0

GET
H/1.1 200
OK CookieSyncLKQD
rtb.adentifi.com/ Frame EFEA 0
88 B 416ms
97ms Image
text/plain 52.202.121.118
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncLKQD
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.121.118 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-202-121-118.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET sync
x.bidswitch.net/ Frame EFEA 0
0

GET
H/1.1 200
OK genericusersync.ashx
sync.tidaltv.com/ Frame EFEA 42 B
320 B 33ms
28ms Image
image/gif 63.32.138.7
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.tidaltv.com/genericusersync.ashx?dpid=3162

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.32.138.7 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-63-32-138-7.eu-west-1.compute.amazonaws.com

Software

Apache-Coyote/1.1 /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Apr 2019 00:40:23 GMT
Server: Apache-Coyote/1.1
Content-Type: image/gif
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Length: 42
X-XSS-Protection: 1; mode=block
Expires: 0

GET

us.php
gu.dyntrk.com/adx/lkqd/ Frame EFEA
Redirect Chain

https://gu.dyntrk.com/adx/lkqd/us.php?dynk=l1k4q1d4&gdpr=&gdpr_consent=
https://sync.search.spotxchange.com/partner?adv_id=6960&udat=&img=0&redir=https%3A%2F%2Fgu.dyntrk.com%2Fadx%2Flkqd%2Fus.php%3Fb64%3DZHluaz1sMWs0cTFkNCZnZHByPSZnZHByX2NvbnNlbnQ9%26spotx_call%3D1%26k...
https://sync.search.spotxchange.com/partner?adv_id=6960&udat=&img=0&redir=https%3A%2F%2Fgu.dyntrk.com%2Fadx%2Flkqd%2Fus.php%3Fb64%3DZHluaz1sMWs0cTFkNCZnZHByPSZnZHByX2NvbnNlbnQ9%26spotx_call%3D1%26k...
https://gu.dyntrk.com/adx/lkqd/us.php?b64=ZHluaz1sMWs0cTFkNCZnZHByPSZnZHByX2NvbnNlbnQ9&spotx_call=1&kwn=0&spotx_uid=e821ab07-6304-11e9-9d19-174deb1e0d06

0
0

GET 37030
stags.bluekai.com/site/ Frame EFEA 0
0

GET
H2

200

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://media.sabio.us/imp_pixel?invsrc=11&secure=1
https://cs.lkqd.net/cs?partnerId=39&partnerUserId=5579916804131786966

43 B
584 B

90ms
89ms

Image
image/gif

146.20.129.23
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=39&partnerUserId=5579916804131786966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.23 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:26 GMT
server: nginx
access-control-allow-origin: *
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

status: 302
date: Sat, 20 Apr 2019 00:40:26 GMT
server: Apache/2.4.23 (Unix)
content-length: 257
location: https://cs.lkqd.net/cs?partnerId=39&partnerUserId=5579916804131786966
content-type: text/html; charset=iso-8859-1

GET usermatch.gif
beacon.krxd.net/ Frame EFEA 0
0

GET lkqd
track.eyeviewads.com/sync/ Frame EFEA 0
0

GET
H/1.1

200
OK

genericusersync.ashx
sync.tidaltv.com/ Frame EFEA
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=lkqd
https://dpm.demdex.net/ibs:dpid=445&dpuuid=25157a45-f80c-42f2-9648-8138351e9017?redir=https%3A%2F%2Fsync.tidaltv.com%2Fgenericusersync.ashx%3Fdpid%3D1262&gdpr=1&gdpr_consent=
https://sync.tidaltv.com/genericusersync.ashx?dpid=1262
https://tags.bluekai.com/site/5379?id=25157a45-f80c-42f2-9648-8138351e9017&redir=https%3A%2F%2Fsync.tidaltv.com%2Fgenericusersync.ashx%3Fdpid%3D1263&gdpr=1&gdpr_consent=
https://sync.tidaltv.com/genericusersync.ashx?dpid=1263

42 B
320 B

31ms
30ms

Image
image/gif

34.247.108.7
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.tidaltv.com/genericusersync.ashx?dpid=1263

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.108.7 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-34-247-108-7.eu-west-1.compute.amazonaws.com

Software

Apache-Coyote/1.1 /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Apr 2019 00:40:31 GMT
Server: Apache-Coyote/1.1
Content-Type: image/gif
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Length: 42
X-XSS-Protection: 1; mode=block
Expires: 0

Redirect headers

Location: https://sync.tidaltv.com/genericusersync.ashx?dpid=1263
Date: Sat, 20 Apr 2019 00:40:31 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: d522
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=c09b4c7a-cf51-4f9d-988d-8b1b5956bd03&r=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D51%26partnerUserId%3D
https://us-u.openx.net/w/1.0/cm?cc=1&id=c09b4c7a-cf51-4f9d-988d-8b1b5956bd03&r=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D51%26partnerUserId%3D
https://cs.lkqd.net/cs?partnerId=51&partnerUserId=4a04bddc-81d3-433c-92a9-2ca5674db755

0
0

GET
H2

200

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/aUTuBPNf?redir=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D52%26partnerUserId%3D%24%7BUSER_ID%7D
https://cs.lkqd.net/cs?partnerId=52&partnerUserId=XLpqeAAAAEIeSQFr

43 B
532 B

95ms
94ms

Image
image/gif

146.20.129.23
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=52&partnerUserId=XLpqeAAAAEIeSQFr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.23 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: *
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

pragma: no-cache
date: Sat, 20 Apr 2019 00:40:24 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1555720824.280280,VS0,VE0
location: https://cs.lkqd.net/cs?partnerId=52&partnerUserId=XLpqeAAAAEIeSQFr
x-cache: HIT
status: 302
cache-control: no-cache
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-hhn1520-HHN

GET
H2

200

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=561322&ev=1&rurl=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D53%26partnerUserId%3D%25%25VGUID%25%25
https://cs.lkqd.net/cs?partnerId=53&partnerUserId=o7bTOHA38kSO&ev=1&pid=561322

43 B
481 B

92ms
90ms

Image
image/gif

146.20.129.23
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=53&partnerUserId=o7bTOHA38kSO&ev=1&pid=561322
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.23 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: *
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

Date: Sat, 20 Apr 2019 00:40:24 GMT
Via: 1.1 varnish
Transfer-Encoding: chunked
X-Cache: MISS
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
x-envoy-upstream-service-time: 0
Connection: keep-alive
X-Served-By: cache-hhn1551-HHN
server: envoy
content-language: en
location: https://cs.lkqd.net/cs?partnerId=53&partnerUserId=o7bTOHA38kSO&ev=1&pid=561322
expires: -1
cache-control: private, max-age=0, no-cache, no-store
Accept-Ranges: bytes
cw-server: bh-deployment-f4b6bdcf9-rs5ht
X-Cache-Hits: 0

GET
H/1.1

200
OK

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://csync.loopme.me/?redirect=http%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D54%26partnerUserId%3D%7Bdevice_id%7D
http://cs.lkqd.net/cs?partnerId=54&partnerUserId=23dadbee-ebda-4d5d-86d4-3a4134d80fb8

43 B
850 B

716ms
89ms

Image
image/gif

146.20.129.32
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cs.lkqd.net/cs?partnerId=54&partnerUserId=23dadbee-ebda-4d5d-86d4-3a4134d80fb8
Protocol: HTTP/1.1
Server: 146.20.129.32 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 20 Apr 2019 00:40:27 GMT
Server: nginx
Access-Control-Max-Age: 0
Access-Control-Allow-Methods: GET
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Content-Disposition
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type
Content-Length: 43

Redirect headers

location: http://cs.lkqd.net/cs?partnerId=54&partnerUserId=23dadbee-ebda-4d5d-86d4-3a4134d80fb8
date: Sat, 20 Apr 2019 00:40:27 GMT
x-envoy-upstream-service-time: 1
content-length: 0

GET
H2 204 464986.gif
idsync.rlcdn.com/ Frame EFEA 0
34 B 97ms
96ms Image
text/plain 52.22.180.243
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/464986.gif?partner_uid=4xvfuQ9MXgc
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.180.243 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-22-180-243.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 204
date: Sat, 20 Apr 2019 00:40:24 GMT

GET rtset
bh.contextweb.com/bh/ Frame EFEA 0
0

GET
H2

200

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm&google_sc
https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEBhBVEhZWrsOgZbdlX2bWDg&google_cver=1

43 B
588 B

90ms
90ms

Image
image/gif

146.20.129.23
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEBhBVEhZWrsOgZbdlX2bWDg&google_cver=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.23 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:27 GMT
server: nginx
access-control-allow-origin: *
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

pragma: no-cache
date: Sat, 20 Apr 2019 00:40:26 GMT
server: HTTP server (unknown)
location: https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEBhBVEhZWrsOgZbdlX2bWDg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 296
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET getuid
cookie.brealtime.com/ Frame EFEA 0
0

GET
H2

200

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://dt-secure.videohub.tv/v1/tpsync/lkqd_direct
https://cs.lkqd.net/cs?partnerId=61&partnerUserId=aaffbb5a227821825fbae96863f19d24

43 B
620 B

90ms
89ms

Image
image/gif

146.20.129.23
Rackspace Hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=61&partnerUserId=aaffbb5a227821825fbae96863f19d24
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.23 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 20 Apr 2019 00:40:28 GMT
server: nginx
access-control-allow-origin: *
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

Location: https://cs.lkqd.net/cs?partnerId=61&partnerUserId=aaffbb5a227821825fbae96863f19d24
Date: Sat, 20 Apr 2019 00:40:28 GMT
useSecure: true
Server: nginx/1.10.3
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

Pug
image2.pubmatic.com/AdServer/ Frame EFEA
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156759&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156759%26pr%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D63%2526part...
http://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc
http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&piggybackCookie=CAESEKS05Ly9IfxeQ6K1FZmnTi8&google_cver=1

42 B
866 B

128ms
14ms

Image
image/gif

185.64.189.110
PubMatic

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&piggybackCookie=CAESEKS05Ly9IfxeQ6K1FZmnTi8&google_cver=1
Protocol: HTTP/1.1
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Apr 2019 00:40:29 GMT
X-lat: Pug22041:0:439
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Cache-Control: no-store, no-cache, private
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
X-Cnection: close
Content-Type: image/gif; charset=utf-8
Content-Length: 42

Redirect headers

Pragma: no-cache
Date: Sat, 20 Apr 2019 00:40:28 GMT
Server: HTTP server (unknown)
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&piggybackCookie=CAESEKS05Ly9IfxeQ6K1FZmnTi8&google_cver=1
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Content-Length: 349
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

cs
ad.turn.com/r/ Frame EFEA
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156759&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156759%26pr%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D69%2526part...
http://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=

0
0

GET
H/1.1

200
OK

Pug
image2.pubmatic.com/AdServer/ Frame EFEA
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156759&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156759%26pr%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D70%2526part...
http://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
http://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9d296baf-96f5-437b-b523-ad4a54ac3046

42 B
893 B

1001ms
15ms

Image
image/gif

185.64.189.110
PubMatic

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9d296baf-96f5-437b-b523-ad4a54ac3046
Protocol: HTTP/1.1
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 20 Apr 2019 00:40:35 GMT
X-lat: Pug22023:0:508
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Cache-Control: no-store, no-cache, private
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
X-Cnection: close
Content-Type: image/gif; charset=utf-8
Content-Length: 42

Redirect headers

Pragma: no-cache
Date: Sat, 20 Apr 2019 00:40:34 GMT
X-AspNet-Version: 4.0.30319
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
Location: http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9d296baf-96f5-437b-b523-ad4a54ac3046
Cache-Control: private,no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/html
Content-Length: 309

GET

cs
cs.lkqd.net/ Frame EFEA
Redirect Chain

https://x.mdhv.io/lq?4xvfuQ9MXgc
https://cs.lkqd.net/cs?partnerId=74&partnerUserId=T5E5XT_eRy21Q7DvedLH4g

0
0

GET p-E357uSpKxfQzx.gif
cms.quantserve.com/pixel/ Frame EFEA 0
0

GET img
sync.mathtag.com/sync/ Frame EFEA 0
0

GET sync.gif
dmp.truoptik.com/3923b09f010b3783/ Frame EFEA 0
0

GET
H/1.1 200
OK vadtag.html Show response
vpaid.pubmatic.com/ads/video/ 2 KB
1 KB 27ms
26ms XHR
application/xml 2.18.233.180
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://vpaid.pubmatic.com/ads/video/vadtag.html?adtype=13&pubId=156498&siteId=399115&adId=1801592&vadFmt=2&vapi=2&vminl=1&vmaxl=181&vh=225&vw=400&placement=1&vtype=1&vpos=1&vplay=2&vskip=0&vcom=0&vfmt=1+3+5+6+7+9+11&sec=1&gdpr=&gdpr_consent=&kadpageurl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 28f8eb219efc8ef1664c2b326d684b97eb382e6db07174bad8e15806516a0c22

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://email-bofa-promo.webcindario.com/bankofamerica/b67ae54e/challengevdl.php?cmd=_account-details&session=39c3f2e89bdfb124943c8ee3a989bb96&dispatch=4601be06cfbd4e972afd454dfe61ffbf609352c8
Origin: https://email-bofa-promo.webcindario.com

Response headers

Pragma: no-cache
Date: Sat, 20 Apr 2019 00:40:24 GMT
Content-Encoding: gzip
Server: Apache/2.2.15 (CentOS)
ETag: "461ced-2da6-583e0acf068a5"
Vary: Origin, Accept-Encoding
Content-Type: application/xml
Access-Control-Allow-Origin: https://email-bofa-promo.webcindario.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 716
Expires: Sat, 20 Apr 2019 00:40:24 GMT

OPTIONS
H2 200 t Show response
t.lkqd.net/ Frame 1FA9 0
300 B 103ms
101ms XHR
text/plain 146.20.129.1
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.1 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://email-bofa-promo.webcindario.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: https://email-bofa-promo.webcindario.com
access-control-max-age: 300
access-control-allow-methods: GET, OPTIONS, POST
content-type: text/plain; charset=UTF-8
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=300
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: image/png

GET PMAdMgr.js
vpaid.pubmatic.com/ads/video/ Frame 35D9 0
0

GET
DATA 200
OK truncated
/ 35 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90252ef0aa9e3d36c861bbeaa1bd57b7f855333edf2957ab9473838a52e2dd7f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: image/gif

POST
H2 200 t Show response
t.lkqd.net/ Frame 1FA9 0
175 B 93ms
92ms XHR
text/plain 146.20.128.132
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.132 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com
Content-Type: application/json

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
status: 200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 0

POST
H2 200 t Show response
t.lkqd.net/ Frame 1FA9 0
175 B 95ms
94ms XHR
text/plain 146.20.128.132
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.132 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com
Content-Type: application/json

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
status: 200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 0

OPTIONS
H2 200 t Show response
t.lkqd.net/ Frame 1FA9 0
300 B 102ms
101ms XHR
text/plain 146.20.129.1
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/vpaid.js?fusion=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.129.1 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://email-bofa-promo.webcindario.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
access-control-allow-origin: https://email-bofa-promo.webcindario.com
access-control-max-age: 300
access-control-allow-methods: GET, OPTIONS, POST
content-type: text/plain; charset=UTF-8
status: 200
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=300
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0

POST
H2 200 t Show response
t.lkqd.net/ Frame 1FA9 0
175 B 93ms
93ms XHR
text/plain 146.20.128.132
Rackspace Hosting

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.132 San Antonio, United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://email-bofa-promo.webcindario.com
Content-Type: application/json

Response headers

date: Sat, 20 Apr 2019 00:40:24 GMT
server: nginx
status: 200
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://email-bofa-promo.webcindario.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.sunmedia.tv
URL: https://static.sunmedia.tv/SMVpaidCreatives/geotarget/eu_country.php

Domain: static.sunmedia.tv
URL: https://static.sunmedia.tv/SMSdk/tracker/outstream.json

Domain: x.bidswitch.net
URL: https://x.bidswitch.net/sync?ssp=lkqd

Domain: gu.dyntrk.com
URL: https://gu.dyntrk.com/adx/lkqd/us.php?b64=ZHluaz1sMWs0cTFkNCZnZHByPSZnZHByX2NvbnNlbnQ9&spotx_call=1&kwn=0&spotx_uid=e821ab07-6304-11e9-9d19-174deb1e0d06

Domain: stags.bluekai.com
URL: https://stags.bluekai.com/site/37030?id=4xvfuQ9MXgc&limit=1

Domain: beacon.krxd.net
URL: https://beacon.krxd.net/usermatch.gif?partner=lkqd&partner_uid=4xvfuQ9MXgc

Domain: track.eyeviewads.com
URL: https://track.eyeviewads.com/sync/lkqd

Domain: cs.lkqd.net
URL: https://cs.lkqd.net/cs?partnerId=51&partnerUserId=4a04bddc-81d3-433c-92a9-2ca5674db755

Domain: bh.contextweb.com
URL: https://bh.contextweb.com/bh/rtset?pid=561322&ev=1&rurl=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D57%26partnerUserId%3D%25%25VGUID%25%25

Domain: cookie.brealtime.com
URL: https://cookie.brealtime.com/getuid?https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D60%26partnerUserId%3D%24UID

Domain: ad.turn.com
URL: http://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=

Domain: cs.lkqd.net
URL: https://cs.lkqd.net/cs?partnerId=74&partnerUserId=T5E5XT_eRy21Q7DvedLH4g

Domain: cms.quantserve.com
URL: https://cms.quantserve.com/pixel/p-E357uSpKxfQzx.gif?idmatch=0

Domain: sync.mathtag.com
URL: https://sync.mathtag.com/sync/img?mt_exid=88&redir=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D77%26partnerUserId%3D%5BMM_UUID%5D

Domain: dmp.truoptik.com
URL: https://dmp.truoptik.com/3923b09f010b3783/sync.gif

Domain: vpaid.pubmatic.com
URL: https://vpaid.pubmatic.com/ads/video/PMAdMgr.js?adtype=13&pubId=156498&siteId=399115&adId=1801592&vadFmt=2&vapi=2&vminl=1&vmaxl=181&vh=225&vw=400&placement=1&vtype=1&vpos=1&vplay=2&vskip=0&vcom=0&vfmt=1+3+5+6+7+9+11&sec=1&gdpr=&gdpr_consent=&kadpageurl=https%3A%2F%2Femail-bofa-promo.webcindario.com%2Fbankofamerica%2Fb67ae54e%2Fchallengevdl.php%3Fcmd%3D_account-details%26session%3D39c3f2e89bdfb124943c8ee3a989bb96%26dispatch%3D4601be06cfbd4e972afd454dfe61ffbf609352c8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 00:08:41	Name: test_cookie Value: CheckForPermission
.email-bofa-promo.webcindario.com/	1970-01-19 00:08:40	Name: _gat_UA-597118-7 Value: 1
.email-bofa-promo.webcindario.com/	1970-01-19 00:10:07	Name: _gid Value: GA1.3.1422450699.1555720824
.email-bofa-promo.webcindario.com/	1970-01-19 17:39:52	Name: _ga Value: GA1.3.2028115426.1555720824

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.lkqd.net
ad.turn.com
ads.vidoomy.com
adservice.google.com
adservice.google.de
beacon.krxd.net
bh.contextweb.com
cm.g.doubleclick.net
cms.quantserve.com
cookie.brealtime.com
cs.lkqd.net
csync.loopme.me
dmp.truoptik.com
dpm.demdex.net
dt-secure.videohub.tv
email-bofa-promo.webcindario.com
googleads.g.doubleclick.net
gu.dyntrk.com
hosting.miarroba.info
idsync.rlcdn.com
image2.pubmatic.com
image8.pubmatic.com
match.adsrvr.org
media.sabio.us
pagead2.googlesyndication.com
rtb.adentifi.com
stags.bluekai.com
static.addevweb.com
static.sunmedia.tv
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.mathtag.com
sync.tidaltv.com
t.lkqd.net
tags.bluekai.com
track.eyeviewads.com
v.lkqd.net
vpaid.pubmatic.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
ad.turn.com
beacon.krxd.net
bh.contextweb.com
cms.quantserve.com
cookie.brealtime.com
cs.lkqd.net
dmp.truoptik.com
gu.dyntrk.com
stags.bluekai.com
static.sunmedia.tv
sync.mathtag.com
track.eyeviewads.com
vpaid.pubmatic.com
x.bidswitch.net
104.111.241.32
116.202.39.4
146.20.128.132
146.20.129.1
146.20.129.102
146.20.129.187
146.20.129.23
146.20.129.32
151.101.0.166
151.101.2.49
172.217.23.130
185.103.39.29
185.64.189.110
185.64.189.216
2.18.233.180
205.185.216.10
205.185.216.42
216.58.205.226
2606:4700:20::6819:ce08
2a00:1450:4001:809::2002
2a00:1450:4001:814::2008
2a00:1450:4001:815::2002
2a00:1450:4001:81c::200e
2a00:1450:4001:81d::2002
2a00:1450:4001:81e::2004
2a00:1450:4001:81f::2003
2a00:1450:4001:821::2002
2a00:1450:400c:c08::9a
3.17.116.255
34.246.249.223
34.247.108.7
5.57.226.202
51.68.180.203
52.202.121.118
52.22.180.243
54.209.157.57
63.32.138.7
63.32.166.115
67.226.210.14
021ece809cc629f17524c1e4de64b3a3d88960389d5b4dc052d3e82e70ff93ba
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
10e2cc38b5e1416293227b1eeb8a504949c68b23f8414dbdd45a07f5d3f4ed3f
1dbaa336651d898b99626cd80ec5f2ca9b0971429d6e0d9c20bead1322c362c7
28f8eb219efc8ef1664c2b326d684b97eb382e6db07174bad8e15806516a0c22
2e27b804b3f6bd69586532ca796f1a4b4481e4b1e143ab6150619140993c774b
36870b7962d775ac7400b1931ae54b1e978d3495323882bb351b7b7afae46114
3bd5ac9684632300424ca98cbe5c5ee9af57d20ba97ced23899daf5ea9bd6685
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
45fa735c6df15f15a1293a9cb3125033408874bf284280e8bcac23f95ad8feac
4984c39b03cddab1198a70add535b4600ac615d3e938edbec8d2d8b53b9f0a60
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
65cb5cd5882c666a22bf188d80f04fe01f56fbb3428e29d74aa24e3d9b1c783b
72042d3923be4aed26983c927543df8fde3fe290257e4afc1215d3e6d9e8d6c2
7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8
7ed393c0873191e300cd7674d7c5d52ba57ac69092c8d101abe7849967bc3811
8723cae31a124bb3aba17b012e29bfc6360ecba1b40661077000e8a97afa0e55
90252ef0aa9e3d36c861bbeaa1bd57b7f855333edf2957ab9473838a52e2dd7f
94f243198ac37ef309f89bf03a8faf0c93c1c5a45a39f46c1ca7491306b0ac68
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c784c2a098312e5fceb4c1e17903ecb02c39b9164748e2a20bd2bf12d79d1ac
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9fe96f11cd5e87cbfe3e2b73a62fe86ead3517929b425fb84ac287388a6db037
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
b0f184fbe0d818a5c23b5540423a251bef3290d1968df6c9c456f1887d391ec0
c0f538c080adde99f65d125690145594c18684094834db9acad80ed019391d14
c81c2a184926f0de9792b39184045e08acca0d2a72aa59927de411d787d759ac
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c3cc4737389ccda70f782d1d63683a2f0bda244edd13d6a5ab3684ce44e5ac
eb8a566141815a86f0f3869a7144cc182b83c0933f96c3b31d2c4f7141d398a7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

email-bofa-promo.webcindario.com Open in urlscan Pro 5.57.226.202 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

69 Requests

72 %HTTPS

26 %IPv6

34 Domains

44 Subdomains

27 IPs

7 Countries

624 kBTransfer

1611 kBSize

4 Cookies

0 Outgoing links

Redirected requests

69 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

email-bofa-promo.webcindario.com Open in urlscan Pro
5.57.226.202 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

69
Requests

72 %
HTTPS

26 %
IPv6

34
Domains

44
Subdomains

27
IPs

7
Countries

624 kB
Transfer

1611 kB
Size

4
Cookies

69 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!