resources.perimeterx.com Open in urlscan Pro
100.24.141.224 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=
Effective URL:
https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-...
Submission: On July 19 via api (July 19th 2022, 6:08:10 pm UTC) from US — Scanned from DE

Summary HTTP 194 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 44 IPs in 6 countries across 37 domains to perform 194 HTTP transactions. The main IP is 100.24.141.224, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is resources.perimeterx.com.
TLS certificate: Issued by Amazon on March 14th 2022. Valid for: a year.

This is the only time resources.perimeterx.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.17.71.206 104.17.71.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	100.24.141.224 100.24.141.224	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a0b:4d07:101::1 2a0b:4d07:101::1	44239 (PROINITY ...) (PROINITY PROINITY)
4	23.205.237.4 23.205.237.4	16625 (AKAMAI-AS) (AKAMAI-AS)
5	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
39	2a03:b0c0:3:d... 2a03:b0c0:3:d0::143f:d001	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	143.204.89.23 143.204.89.23	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:ef:... 2a02:26f0:ef::5c7b:c2a4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
15	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
4	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4 12	2600:9000:215... 2600:9000:2156:9000:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
13	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:440... 2606:4700:4400::ac40:97c9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	54.220.8.206 54.220.8.206	16509 (AMAZON-02) (AMAZON-02)
4 4	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
5 5	37.252.173.27 37.252.173.27	29990 (ASN-APPNEX) (ASN-APPNEX)
4	2600:9000:215... 2600:9000:2156:8e00:12:3734:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
7	35.186.220.184 35.186.220.184	15169 (GOOGLE) (GOOGLE)
8	54.82.195.36 54.82.195.36	14618 (AMAZON-AES) (AMAZON-AES)
2	34.120.92.56 34.120.92.56	15169 (GOOGLE) (GOOGLE)
3	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	104.16.94.80 104.16.94.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	13.32.99.99 13.32.99.99	16509 (AMAZON-02) (AMAZON-02)
2	18.66.242.175 18.66.242.175	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
2	54.75.54.75 54.75.54.75	16509 (AMAZON-02) (AMAZON-02)
4	2a04:4e42:600... 2a04:4e42:600::604	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
10	143.204.101.166 143.204.101.166	16509 (AMAZON-02) (AMAZON-02)
2	18.64.103.56 18.64.103.56	16509 (AMAZON-02) (AMAZON-02)
2	172.67.75.100 172.67.75.100	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	143.204.89.97 143.204.89.97	16509 (AMAZON-02) (AMAZON-02)
1	18.66.248.127 18.66.248.127	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:a852	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	54.81.167.22 54.81.167.22	14618 (AMAZON-AES) (AMAZON-AES)
4	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	143.204.89.36 143.204.89.36	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
194	44

1 104.17.71.206 (None, )

ASN13335 (CLOUDFLARENET, US)

mkto-sj130112.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 100.24.141.224 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-24-141-224.compute-1.amazonaws.com

resources.perimeterx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:101::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

overpass-30e2.kxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.205.237.4 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-237-4.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a03:b0c0:3:d0::143f:d001 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

www.perimeterx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.23 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-23.fra50.r.cloudfront.net

cdn-app.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ef::5c7b:c2a4 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

client.px-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2600:9000:2156:9000:6:9280:1080:93a1 (United States) 4 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::ac40:97c9 (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.220.8.206 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-220-8-206.eu-west-1.compute.amazonaws.com

cnv.event.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.153.60 (Secaucus, United States) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 37.252.173.27 (Frankfurt am Main, Germany) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2156:8e00:12:3734:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.186.220.184 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 184.220.186.35.bc.googleusercontent.com

sapi2003.botchk.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.82.195.36 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-195-36.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.92.56 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 56.92.120.34.bc.googleusercontent.com

b.px-cdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.94.80 (None, )

ASN13335 (CLOUDFLARENET, US)

app-sj13.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.32.99.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-99.fra60.r.cloudfront.net

app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.242.175 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-242-175.dus51.r.cloudfront.net

d33wubrfki0l68.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

001-vjx-104.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.75.54.75 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-54-75.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:4e42:600::604 (United States)

ASN54113 (FASTLY, US)

assets.perimeterx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 143.204.101.166 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-101-166.fra50.r.cloudfront.net

d10lpsik1i8c69.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.64.103.56 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-64-103-56.txl50.r.cloudfront.net

lftracker.leadfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.75.100 (United States)

ASN13335 (CLOUDFLARENET, US)

settings.luckyorange.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 143.204.89.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-97.fra50.r.cloudfront.net

tr.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.127 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-127.dus51.r.cloudfront.net

cdn.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.81.167.22 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-167-22.compute-1.amazonaws.com

api9130.d41.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-36.fra50.r.cloudfront.net

cdn-0.d41.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pubsub.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	perimeterx.com resources.perimeterx.com www.perimeterx.com — Cisco Umbrella Rank: 574202 assets.perimeterx.com	706 KB
14	adroll.com 4 redirects s.adroll.com — Cisco Umbrella Rank: 2518 d.adroll.com — Cisco Umbrella Rank: 1676	42 KB
14	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 69 region1.google-analytics.com — Cisco Umbrella Rank: 2603	129 KB
13	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 509	244 KB
12	cloudfront.net d33wubrfki0l68.cloudfront.net d10lpsik1i8c69.cloudfront.net	487 KB
12	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 81 pubsub.googleapis.com — Cisco Umbrella Rank: 2984	3 KB
10	pathfactory.com cdn-app.pathfactory.com — Cisco Umbrella Rank: 102986 jukebox.pathfactory.com — Cisco Umbrella Rank: 59730 cdn.pathfactory.com — Cisco Umbrella Rank: 154348	485 KB
7	botchk.net sapi2003.botchk.net — Cisco Umbrella Rank: 741111	3 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 485 www.linkedin.com — Cisco Umbrella Rank: 534 px4.ads.linkedin.com — Cisco Umbrella Rank: 5743	4 KB
5	lfeeder.com tr.lfeeder.com — Cisco Umbrella Rank: 14557	1 KB
5	adnxs.com 5 redirects secure.adnxs.com — Cisco Umbrella Rank: 436	4 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 101	317 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	490 B
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 164	219 KB
4	lookbookhq.com app.cdn.lookbookhq.com — Cisco Umbrella Rank: 70913	369 KB
4	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 18756	969 B
4	ml-attr.com 4 redirects s.ml-attr.com — Cisco Umbrella Rank: 15386	1 KB
4	youtube.com www.youtube.com — Cisco Umbrella Rank: 107	105 KB
4	licdn.com snap.licdn.com — Cisco Umbrella Rank: 914	13 KB
4	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3954	13 KB
3	d41.co api9130.d41.co cdn-0.d41.co — Cisco Umbrella Rank: 18236	77 KB
3	gstatic.com fonts.gstatic.com	86 KB
3	bidr.io 1 redirects cnv.event.prod.bidr.io — Cisco Umbrella Rank: 9373	2 KB
2	luckyorange.net settings.luckyorange.net — Cisco Umbrella Rank: 7869	3 KB
2	leadfeeder.com lftracker.leadfeeder.com — Cisco Umbrella Rank: 62386	21 KB
2	mktoresp.com 001-vjx-104.mktoresp.com	636 B
2	px-cdn.net b.px-cdn.net — Cisco Umbrella Rank: 14532	422 B
2	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8951	1 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 819	77 KB
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 6139	2 KB
1	google.de www.google.de — Cisco Umbrella Rank: 4915	501 B
1	google.com www.google.com — Cisco Umbrella Rank: 17	501 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 138	448 B
1	marketo.com app-sj13.marketo.com — Cisco Umbrella Rank: 204563	69 KB
1	px-cloud.net client.px-cloud.net — Cisco Umbrella Rank: 8081	136 KB
1	kxcdn.com overpass-30e2.kxcdn.com — Cisco Umbrella Rank: 226419	842 B
1	mkto-sj130112.com mkto-sj130112.com	1 KB
194	37

	Domain	Requested by
39	www.perimeterx.com	resources.perimeterx.com www.perimeterx.com d33wubrfki0l68.cloudfront.net
13	cdn.cookielaw.org	www.googletagmanager.com client.px-cloud.net cdn.cookielaw.org
12	s.adroll.com	4 redirects www.googletagmanager.com resources.perimeterx.com client.px-cloud.net www.perimeterx.com s.adroll.com
11	www.google-analytics.com	www.googletagmanager.com client.px-cloud.net www.perimeterx.com
10	pubsub.googleapis.com	d10lpsik1i8c69.cloudfront.net client.px-cloud.net
10	d10lpsik1i8c69.cloudfront.net	client.px-cloud.net mkto-sj130112.com d10lpsik1i8c69.cloudfront.net resources.perimeterx.com
8	jukebox.pathfactory.com	cdn-app.pathfactory.com client.px-cloud.net
7	sapi2003.botchk.net	client.px-cloud.net
5	tr.lfeeder.com	resources.perimeterx.com www.perimeterx.com
5	secure.adnxs.com	5 redirects
5	www.googletagmanager.com	resources.perimeterx.com www.googletagmanager.com www.perimeterx.com
4	www.facebook.com	resources.perimeterx.com www.perimeterx.com
4	connect.facebook.net	client.px-cloud.net mkto-sj130112.com connect.facebook.net
4	assets.perimeterx.com	www.perimeterx.com
4	app.cdn.lookbookhq.com	www.perimeterx.com client.px-cloud.net mkto-sj130112.com
4	attr.ml-api.io	resources.perimeterx.com www.perimeterx.com
4	s.ml-attr.com	4 redirects
4	www.youtube.com	mkto-sj130112.com client.px-cloud.net www.youtube.com
4	snap.licdn.com	www.googletagmanager.com client.px-cloud.net
4	munchkin.marketo.net	resources.perimeterx.com munchkin.marketo.net mkto-sj130112.com
3	fonts.gstatic.com	fonts.googleapis.com
3	px.ads.linkedin.com	3 redirects
3	region1.google-analytics.com	client.px-cloud.net www.googletagmanager.com
3	cnv.event.prod.bidr.io	1 redirects resources.perimeterx.com www.perimeterx.com
2	api9130.d41.co	www.googletagmanager.com cdn-0.d41.co
2	settings.luckyorange.net	client.px-cloud.net d10lpsik1i8c69.cloudfront.net
2	lftracker.leadfeeder.com	client.px-cloud.net mkto-sj130112.com
2	d.adroll.com	client.px-cloud.net s.adroll.com
2	001-vjx-104.mktoresp.com	client.px-cloud.net munchkin.marketo.net
2	px4.ads.linkedin.com	resources.perimeterx.com www.perimeterx.com
2	d33wubrfki0l68.cloudfront.net	www.perimeterx.com
2	b.px-cdn.net	client.px-cloud.net
2	tracking.g2crowd.com	mkto-sj130112.com
2	maxcdn.bootstrapcdn.com	resources.perimeterx.com maxcdn.bootstrapcdn.com
2	fonts.googleapis.com	resources.perimeterx.com www.perimeterx.com
1	cdn-0.d41.co	www.googletagmanager.com
1	ws.zoominfo.com	mkto-sj130112.com
1	cdn.pathfactory.com	resources.perimeterx.com
1	www.google.de	resources.perimeterx.com
1	www.google.com	resources.perimeterx.com
1	stats.g.doubleclick.net	client.px-cloud.net
1	www.linkedin.com	1 redirects
1	app-sj13.marketo.com	www.perimeterx.com
1	client.px-cloud.net	resources.perimeterx.com
1	cdn-app.pathfactory.com	resources.perimeterx.com
1	overpass-30e2.kxcdn.com	resources.perimeterx.com
1	resources.perimeterx.com	mkto-sj130112.com
1	mkto-sj130112.com
194	48

This site contains links to these domains. Also see Links.

Domain
onetrust.com
www.perimeterx.com

Subject Issuer	Validity	Valid
mkto-sj130112.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
resources.perimeterx.com Amazon	`2022-03-14` - `2023-04-12`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
*.kxcdn.com Thawte RSA CA 2018	`2021-08-28` - `2022-08-28`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
beat.bot R3	`2022-06-04` - `2022-09-02`	3 months	crt.sh
*.pathfactory.com Amazon	`2022-07-11` - `2023-08-09`	a year	crt.sh
botchk.net R3	`2022-05-04` - `2022-08-02`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
s.adroll.com Amazon	`2022-07-03` - `2023-08-01`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.g2crowd.com Sectigo ECC Domain Validation Secure Server CA	`2021-08-30` - `2022-09-28`	a year	crt.sh
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA	`2021-09-01` - `2022-09-30`	a year	crt.sh
perimeterx.net GeoTrust RSA CA 2018	`2021-08-18` - `2022-09-18`	a year	crt.sh
app-sj13.marketo.com Cloudflare Inc ECC CA-3	`2022-04-29` - `2023-04-29`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
adroll.mgr.consensu.org Amazon	`2021-09-09` - `2022-10-08`	a year	crt.sh
assets.perimeterx.com GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-07-07` - `2023-08-08`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-04-28` - `2022-07-27`	3 months	crt.sh
*.leadfeeder.com Amazon	`2022-02-01` - `2023-03-02`	a year	crt.sh
*.lfeeder.com Amazon	`2022-07-09` - `2023-08-07`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.d41.co DigiCert TLS RSA SHA256 2020 CA1	`2022-02-01` - `2023-03-04`	a year	crt.sh
*.event.prod.bidr.io Amazon	`2022-01-27` - `2023-02-25`	a year	crt.sh
edgecert.googleapis.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Frame ID: 9561C9290E80AB720730BEC9373550B8
Requests: 74 HTTP requests in this frame

Frame: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Frame ID: B28743E8972698C43F47CB35DDF48A8C
Requests: 101 HTTP requests in this frame

Frame: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Frame ID: 5620FE3651182CE1AA66D4B6B6CA29AF
Requests: 5 HTTP requests in this frame

Frame: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Frame ID: C927AB9208AA9938A015FAE151EE14CD
Requests: 6 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 5D7B4A867ED214882A3CEC648C69627A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

An Analysis of the Natural Fresh Mall Magecart AttackBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSM... Page URL
https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 75%
Detected patterns

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Marketo Forms (Widgets) Expand

Overall confidence: 100%
Detected patterns

marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

194
Requests

92 %
HTTPS

50 %
IPv6

37
Domains

48
Subdomains

44
IPs

6
Countries

3614 kB
Transfer

10895 kB
Size

54
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

URL: https://www.perimeterx.com/legal/privacy/
Title: privacy policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A= Page URL
https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=[ORDER]&ord=454865905 HTTP 303
https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=454865905&_bee_ppp=1

Request Chain 17

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dperimeterx.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

Request Chain 56

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D48062%26time%3D1658254084167%26url%3Dhttps%253A%252F%252Fresources.perimeterx.com%252Fnews-naturalfresh-magecart-analysis%253Fmkt_tok%253DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%2526utm_campaign%253Dnewsletter-july-2022%2526utm_source%253Dmarketo%2526utm_medium%253Demail%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true&e_ipv6=AQLAAfPye5JYWQAAAYIXpUp3tI46zgeLSLkxdkQ8xUrxzl_T8GrCE1hAI8W4NSw5

Request Chain 58

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 59

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

Request Chain 95

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084680&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084680&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&e_ipv6=AQJ-hF41u8dRXQAAAYIXpUqcWFsX6DVj5LZiRnAsapZmOU5JgIX8hAwieYR3Hu04

Request Chain 100

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 101

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

Request Chain 118

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

Request Chain 164

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

Request Chain 165

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID HTTP 302
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

194 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 302 MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=
mkto-sj130112.com/ 627 B
1 KB 221ms
189ms Document
text/html 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-bM8752GdLsMZ0sWpB998JRzg1sYQncSTekj5MQ+bDY8=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-cache, no-store, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 72d566716bd668e9-FRA
content-security-policy: default-src 'self'; img-src 'self';script-src 'self' 'sha256-bM8752GdLsMZ0sWpB998JRzg1sYQncSTekj5MQ+bDY8=';object-src 'none';form-action:'none';frame-src:'none'
content-type: text/html;charset=UTF-8
date: Tue, 19 Jul 2022 18:08:02 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: strict-origin
server: cloudflare
x-frame-options: SAMEORIGIN
x-request-id: 9162249fca20022e

GET
H2 200 Primary Request news-naturalfresh-magecart-analysis Show response
resources.perimeterx.com/ 19 KB
7 KB 579ms
201ms Document
text/html 100.24.141.224
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.24.141.224 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-141-224.compute-1.amazonaws.com

Software

Resource Hash

0ba0fbfb76e99495c054bc3ae1b7f31e32a98266995fe3cb27a767661c2e07df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://mkto-sj130112.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 19 Jul 2022 18:08:03 GMT
etag: W/"0ba0fbfb76e99495c054bc3ae1b7f31e"
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin Accept-Encoding
x-content-type-options: nosniff
x-request-id: 41d19453-5c9d-4ddb-a60e-31a5642cac6b
x-runtime: 0.091929

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 47ms
18ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700|Lato:400,700

Requested by

Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

390aca4ba708128182c4802df7c4a1d3a85566b96bf2542caa3b4ea1f1507c1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Jul 2022 18:08:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 19 Jul 2022 18:08:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Jul 2022 18:08:03 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 45ms
17ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617
age: 12211463
cdn-cachedat: 2021-06-08 21:36:06
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 0da3e6fa0421515cbcf5425517fc7012
cf-ray: 72d5667679949b33-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 overpass.css
overpass-30e2.kxcdn.com/ 6 KB
842 B 56ms
28ms Stylesheet
text/css 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://overpass-30e2.kxcdn.com/overpass.css
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: b25e835722ffbec8ab733d999dc194aa9ef7fcf00edc594e453f2823e0c65fb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: br
last-modified: Fri, 30 Dec 2016 09:56:37 GMT
server: keycdn-engine
x-edge-location: defr
etag: W/"58662f55-180e"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-headers: *
expires: Tue, 26 Jul 2022 18:08:03 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 149ms
7ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:03 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 278 KB
86 KB 79ms
27ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b1347eb0f9062729600544cef00d2c1b8029c0e6bcc24822292fa0950c861ba0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87979
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:08:03 GMT

GET
H2 200 / Show response
www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Frame B287 98 KB
25 KB 234ms
153ms Document
text/html 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

ca2bc9c7cf7bc7dcaf47481abea6b29fcaeebc55b92b8df622f7feb4242c3ae7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 0
cache-control: public, max-age=0, must-revalidate
content-encoding: br
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-type: text/html; charset=UTF-8
date: Tue, 19 Jul 2022 18:08:03 GMT
etag: "524730e29f519c197fdc7f0ec436730e-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01G8BTAHM6KY2FPD2XS01VY17V
x-xss-protection: 1; mode=block

GET
H2 200 tracks.js Show response
cdn-app.pathfactory.com/production/jukebox/current/ 2 MB
431 KB 107ms
21ms Script
text/javascript 143.204.89.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-23.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b02b20ba6ecbfd77a7b5951a906f6b9e230a607e2bd7002ae7ea79fcd7fdc1a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 01:04:24 GMT
server: AmazonS3
age: 17562
etag: W/"6fda9e6587b709557a0a50e260685a14"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Tue, 19 Jul 2022 13:15:22 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: p0glUOknmtoh_WrmGuQ_VGbPqG_thea0Tgl-pSJhMF3NuNeWrcrebg==

GET
H2 200 main.min.js Show response
client.px-cloud.net/PX2003/ 286 KB
136 KB 97ms
9ms Script
application/javascript 2a02:26f0:ef::5c7b:c2a4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://client.px-cloud.net/PX2003/main.min.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ef::5c7b:c2a4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 4446e54d7bd0f4dbad541c2fcf0778d5fad8278020999a1a9c1f47838310c67b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: gzip
etag: "476f6-9agS4ZAEG9RaCUwjDM22MN5S1C4"
active-cdn: Akamai
x-px-hash: MTAyNWZlNzQxNWRiOTg2YTViODJjNzVmODY4MzQ2YTg4YWY0N2MxODk0M2IxOTdmYTUzNDNhNjcxNDY0ZDk4YQ==
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: active-cdn,x-served-by,Akamai-Request-BC
cache-control: max-age=900,stale-while-revalidate=86400,stale-if-error=3600
content-length: 138262

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
72 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S5CWZF51H2&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

866fd0f98742f8922ccca3f48c527a43f7106544bc1831f8cb514d0e39200b57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74015
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:08:03 GMT

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 117 KB
45 KB 51ms
24ms Script
application/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-PCDTQ25

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2332c2b8154bc345a95686a194571690df8da39f14af3e3762decc72616c5c2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45245
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:08:03 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 38ms
9ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:03 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80369
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 52 KB
17 KB 70ms
10ms Script
text/javascript 2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: J7p8W1lQgNY91qwUxZU3x.y9IQrTVjMu
Content-Encoding: gzip
Etag: W/"d570d2e0cc47679b5bf3a6f9ff5b9e5b"
Age: 2065
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Last-Modified: Thu, 30 Jun 2022 21:03:48 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 17:33:40 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: BGNbvXuln5Fjm_iX9bT0tI_BYaruFBi6UILEYR3zP0H-IPwc3TKyzg==

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 20 KB
7 KB 37ms
17ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 4m3LBpuQ5au3un+sbdTm6g==
age: 1445
vary: Accept-Encoding
content-length: 6922
x-ms-lease-status: unlocked
last-modified: Thu, 14 Jul 2022 19:31:29 GMT
server: cloudflare
etag: 0x8DA65CF736BBFE4
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 32dfe822-301e-0115-48e4-975c2a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56677cdae691f-FRA

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
2 KB 62ms
35ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fe3cdb6342633b630a1636d3a83f1beb1aa5a9404078a93618f3235f4d609f6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Tue, 19 Jul 2022 18:08:03 GMT

GET
H2 200 4607.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 16 B
1 KB 174ms
133ms Script
text/javascript 2606:4700:4400::ac40:97c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/4607.js?p=https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&e=

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:97c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: 60d1d39b-ba20-4599-90f9-c34d81bfe3ad
x-runtime: 0.002283
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=604800
x-download-options: noopen
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray: 72d56677fffc9a06-FRA

GET
H/1.1

200
OK

cnv
cnv.event.prod.bidr.io/log/
Redirect Chain

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=[ORDER]&ord=454865905
https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=454865905&_bee_ppp=1

43 B
793 B

100ms
100ms

Image
image/gif

54.220.8.206
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=454865905&_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Server

54.220.8.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-220-8-206.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:04 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=%5BORDER%5D&ord=454865905&_bee_ppp=1
Date: Tue, 19 Jul 2022 18:08:04 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dperimeterx.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

0
243 B

368ms
330ms

Image
application/json

2600:9000:2156:8e00:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Server: 2600:9000:2156:8e00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
apigw-requestid: Vhrovj0qIAMESpg=
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: 1PZy4Su1E8HPWElGJkoa_MO_g_Uy2IYX0b2rzL_-ZOuDSYHfKehSyg==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:04 GMT
X-Proxy-Origin: 81.95.5.43; 81.95.5.43; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: f7861e34-473d-4975-8c46-6fc93bda92be
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 collector Show response
sapi2003.botchk.net/api/v2/ 563 B
822 B 68ms
30ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 615f2e915d6e55870aba23f2c73ddf30e8066a6b2d804878938eb4e0ae19353c

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 563

OPTIONS
H2 200 page_views
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 316ms
103ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:08:04 GMT

POST
H2 200 page_views Show response
jukebox.pathfactory.com/api/public/v1/ 153 B
1022 B 376ms
180ms XHR
application/json 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox/current/tracks.js?x=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

f8f977a83336826611839a21da4242f039359c753e6d3e0a825c63450c97f834

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
access-control-max-age: 7200
vary: Accept, Origin, Accept-Encoding
x-request-id: 65c33e69-65c2-4691-b230-4ad36615a036
x-runtime: 0.079045
referrer-policy: no-referrer-when-downgrade
etag: W/"f8f977a83336826611839a21da4242f0"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 24ms
24ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Thu, 27 Oct 2022 18:08:04 GMT

POST
H2 200 p Show response
b.px-cdn.net/api/v1/PX2003/d/ 149 B
403 B 52ms
16ms XHR
application/json 34.120.92.56
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://b.px-cdn.net/api/v1/PX2003/d/p
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.92.56 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 56.92.120.34.bc.googleusercontent.com
Software: /
Resource Hash: 33702c30dd6e5f9c0a3a1ad110951d3c7cf9d60ff0afc05af77bcadf1ff97197

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: multipart/form-data; boundary=----------------hcgpbq9rz88hl5hp

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
via: 1.1 google
access-control-allow-headers: authorization
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/json
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 149

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/ 159 KB
51 KB 33ms
7ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0da1fc9c1b23d76d5b0f9d3154f4141b30a6926b68523c37ec483dd0200945a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:18:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2978
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52491
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 00:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 19 Jul 2023 17:18:26 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
353 B 42ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-S5CWZF51H2&gtm=2oe7i0&_p=1182229276&_z=ccd.v9B&cid=2128280482.1658254084&ul=en-us&sr=1600x1200&_s=1&sid=1658254084&sct=1&seg=0&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dr=https%3A%2F%2Fmkto-sj130112.com%2F&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:08:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 forms2.min.js Show response
app-sj13.marketo.com/js/forms2/js/ Frame B287 206 KB
69 KB 175ms
23ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj13.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17dc16f203a20131a9dfccce83ed74af83cb9da328011181ca745b7f3a883d08

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 14 Jun 2022 21:04:07 GMT
server: cloudflare
age: 333
etag: "58130e-3391f-5e16ebec83fc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 72d5667ab9ac9078-FRA
expires: Tue, 19 Jul 2022 22:08:04 GMT

GET
H2 200 overlay.css
app.cdn.lookbookhq.com/libraries/overlay/ Frame B287 569 B
922 B 67ms
8ms Stylesheet
text/css 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/libraries/overlay/overlay.css
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5156dff19f3da0b22f54fae9883fdc4a140ab79ec89aac752751e9fc643159bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
last-modified: Wed, 02 Feb 2022 02:43:20 GMT
server: AmazonS3
age: 48575
etag: "73f6afb49415dbca4824d9ac67763fea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
date: Tue, 19 Jul 2022 04:38:30 GMT
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-length: 569
x-amz-cf-id: xwEG7IUkqHG8yU1LY9ZKlHLhLQ7icPTuj6uGzOSPeKiQ7admuT6LcQ==

GET
H2 200 overlay.js Show response
app.cdn.lookbookhq.com/libraries/overlay/ Frame B287 5 KB
2 KB 67ms
8ms Script
application/javascript 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/libraries/overlay/overlay.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dd11c7626d5576d5cb2c3271bd2a20526c246da6c08c62248c8a944104edd9e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 01:54:41 GMT
server: AmazonS3
age: 57818
etag: W/"0dcf782aadc5db45cfd6d9ef79c1a377"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
date: Tue, 19 Jul 2022 02:04:27 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: NKO2Ys2_cU42f1istod0NpFT9NFsCUT2qmQ_iYpmG_unDb7F4C8eaQ==

GET
H3 200 css
fonts.googleapis.com/ Frame B287 14 KB
952 B 42ms
21ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa7bb01d830f1d1ceb4c4d857e2c6f9de8f72c520f6ee031797d76af89989d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Jul 2022 18:08:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 19 Jul 2022 18:08:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Jul 2022 18:08:04 GMT

GET
H2 200 webpack-runtime-514465b51ac6845ee75f.js Show response
www.perimeterx.com/ Frame B287 15 KB
4 KB 26ms
19ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/webpack-runtime-514465b51ac6845ee75f.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

a61d5737f270e877b7ee2e1ded35a5d6c07cb8e16e316c6a97a1d1dd9d76c1fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ19NQB1V52EH3D1SAK1
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 3799
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "46a1e2d0887e87d92e5c59a2c62e2405-ssl"
accept-ranges: bytes

GET
H2 200 styles-83801f3b4dd3459a4027.js Show response
www.perimeterx.com/ Frame B287 118 B
206 B 36ms
30ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/styles-83801f3b4dd3459a4027.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e5ad1b24f290210e067ee5aeace152e7a510e2e457554bcada5e767292132747

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ183VJ86YQ5YYPH3ZV0
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "e2e8d3c392c3fe79dd753e7dae194a51-ssl"
x-frame-options: DENY
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 118
x-xss-protection: 1; mode=block

GET
H2 200 framework-3bb7604d37b8059061f5.js Show response
www.perimeterx.com/ Frame B287 131 KB
39 KB 41ms
34ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/framework-3bb7604d37b8059061f5.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

f92d6e79a7b51948eb161c71fefce09aa57c0bf009c8d326575950540304d49c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ18YSM5J3Q1R7MNTQBF
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 39977
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "b16b1872f128e3eaf829f3ca941586c2-ssl"
accept-ranges: bytes

GET
H2 200 c9c6fe98-9161238368d370bda929.js Show response
www.perimeterx.com/ Frame B287 92 KB
21 KB 18ms
11ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/c9c6fe98-9161238368d370bda929.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

4da5da2f204eed8829fd9e0ee84e21479ee5db9fb5e6656d05bbdff54b2ce68e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ196QGYAVDMJJGWV7VC
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 21219
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "dd5342ec2edf24e1b612806db7d177ac-ssl"
accept-ranges: bytes

GET
H2 200 1bfc9850-e346f70a0d188b802bed.js Show response
www.perimeterx.com/ Frame B287 5 KB
2 KB 27ms
21ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/1bfc9850-e346f70a0d188b802bed.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

f3d15fff8a4ea22a2137649a7935dc89776c66389936e50e4ba97895099459d6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ19XPBVKVVKVCBP9ZEF
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 2140
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "6122f8ba089db0bbf833a558e8f9b596-ssl"
accept-ranges: bytes

GET
H2 200 5e2a4920-20a4bced7ddf9a73ac28.js Show response
www.perimeterx.com/ Frame B287 2 KB
590 B 34ms
28ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/5e2a4920-20a4bced7ddf9a73ac28.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

71a41da894b51c66bad0e307a8ee51aa86ebf458433676b9c9ea8eb32f695d02

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1AX2FJR2JEZ10EE5RR
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 498
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "e0b7567b94632b2f57e8a301e83b973d-ssl"
accept-ranges: bytes

GET
H2 200 95b64a6e-61f21e012229bde8e9f0.js Show response
www.perimeterx.com/ Frame B287 855 B
944 B 26ms
20ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/95b64a6e-61f21e012229bde8e9f0.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

fdd4315639b20e32f08bc16b37cddf4514c250e34601d29979eb4a2c471304ff

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1AAR2T8XVH1KRV4DFH
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "422f0792968acafc3061ddc509f1d4fa-ssl"
x-frame-options: DENY
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 855
x-xss-protection: 1; mode=block

GET
H2 200 app-ee317304c744ef04cb69.js Show response
www.perimeterx.com/ Frame B287 679 KB
199 KB 27ms
21ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/app-ee317304c744ef04cb69.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ce04db8da4adcd3c61f4538252f865491c78e321bbb499909daa536ea95da24

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ19YVV96CPRVZRX0TQ1
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 203102
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "d2bd825026c51394b42210be7e50f6d8-ssl"
accept-ranges: bytes

GET
H2 200 6d317829-d3d402e5b3de0a374184.js Show response
www.perimeterx.com/ Frame B287 7 KB
2 KB 27ms
21ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/6d317829-d3d402e5b3de0a374184.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

0cb9b072cf2c8c5cabf1fc0ac2b02873e32a1ce13427655ce817cc294eea8fc9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1AN6CCEPX9ZZB02BRQ
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 2055
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "de815af097279cc7781b0505522a33dc-ssl"
accept-ranges: bytes

GET
H2 200 5d29be3a39afb3d02c470836880ef3668828850c-96f6cdc519f233150bf2.js Show response
www.perimeterx.com/ Frame B287 6 KB
2 KB 26ms
21ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/5d29be3a39afb3d02c470836880ef3668828850c-96f6cdc519f233150bf2.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

163c0afdbe5d2a296ee5a962b593854122fb42fb996c9cbbd388c5194aab0efe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1AKYXQAV6RHXJP118F
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 2325
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "5ce87fb9ef7b2ce75c90db5b6cbe65c8-ssl"
accept-ranges: bytes

GET
H2 200 9815f04a81c9d7b5d54b3cfd1cb9f97e68eecb8a-4c69d8ab0a860387cfd2.js Show response
www.perimeterx.com/ Frame B287 3 KB
1 KB 41ms
36ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/9815f04a81c9d7b5d54b3cfd1cb9f97e68eecb8a-4c69d8ab0a860387cfd2.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

abd979a2558bc92d17ef9c6c94d3d93e064cc2f029b85ddb8281eb3372f7253e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1FK4RP1QPBR7MN97VB
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 1082
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "49f9d82645b1dc58226764f91eecd5c3-ssl"
accept-ranges: bytes

GET
H2 200 component---src-layouts-templates-blog-blog-post-js-4cb3b9f77e1259b40c6d.js Show response
www.perimeterx.com/ Frame B287 21 KB
6 KB 41ms
36ms Script
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-blog-blog-post-js-4cb3b9f77e1259b40c6d.js

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

d9df926b2a2ec4e88bbff3a55119b4fc5f2a9fd2d0fee71a12d8e67e03779b95

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1EPVVT2NWDTK6KYDDX
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 5959
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "03232890594582ba7de5d9382bce244e-ssl-df"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Frame B287 14 KB
6 KB 156ms
151ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/page-data.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

eb8f35e2eb63ca25c5339c27b29feddac2eb36cb9709cf83dab3030a71d5d836

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1F0X9R3YFRQE2FDWGY
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 5576
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:04 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "2b1c0a5dce373de46b63a1a3db1ededd-ssl-df"
accept-ranges: bytes

GET
H2 200 105486388.json
www.perimeterx.com/page-data/sq/d/ Frame B287 446 B
546 B 44ms
40ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/105486388.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

9643ad4251cb0b5eac75b7141f9f2109fb2997b3ccfcbbab7ad11c8619adc0b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1GB9G5QCR9P4T9T0P6
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "5dcb9ff19b2bd023415e3fdbc52f37a5-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-length: 446
x-xss-protection: 1; mode=block

GET
H2 200 1081851012.json
www.perimeterx.com/page-data/sq/d/ Frame B287 339 B
428 B 46ms
41ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/1081851012.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

7ed25b46fbeee4d58ba491483c894338542894bfb0ef81839514edf7a2657e58

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1K995A4HNE7VDHDZ62
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "f30ae546842bfcede087b4ac2c37873d-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 339
x-xss-protection: 1; mode=block

GET
H2 200 1351792449.json
www.perimeterx.com/page-data/sq/d/ Frame B287 300 B
414 B 46ms
42ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/1351792449.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

04fac4a0b1ae3f61cbddf6c63d60ad3b419dba7cfd817352c7dc1d2a00e8e48e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1FYVRRH6AJHRND9FVP
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "659cf9327214e3fbc1b61f2549de36c4-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-length: 300
x-xss-protection: 1; mode=block

GET
H2 200 1423242311.json
www.perimeterx.com/page-data/sq/d/ Frame B287 184 B
535 B 47ms
42ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/1423242311.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

7777858e85646ef5fb3a61d3862af526216ae6f199db4bf1c6ad6b2fcde3bf47

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1G5WQAXG38GVAFGJF6
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "94a829a46c33a235386f476dc1a86ffc-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-length: 184
x-xss-protection: 1; mode=block

GET
H2 200 2363503153.json
www.perimeterx.com/page-data/sq/d/ Frame B287 28 KB
5 KB 50ms
45ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/2363503153.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

a48260f238dfb9e6f4530e94e235fc5e97450d0933789322c532a64ee2701ace

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1FGDVQZ9S2DPA94HGH
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 5023
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "09510e8be2e6f208c6dae41942439ed4-ssl-df"
accept-ranges: bytes

GET
H2 200 2641933513.json
www.perimeterx.com/page-data/sq/d/ Frame B287 10 KB
1 KB 47ms
43ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/2641933513.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

0603195f65053eabba0100568898b6d2f29a23dbe3c742391588f9cc5853028a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1GKJPFXE5EF64X9C01
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 1337
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "82faff9c774924b32c3c15cccfe85c71-ssl"
accept-ranges: bytes

GET
H2 200 3302762179.json
www.perimeterx.com/page-data/sq/d/ Frame B287 502 B
590 B 49ms
45ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3302762179.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

42238934ecd53313e8dba8fc5ca2222496d084633c81171a5c70de5d849112af

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1HWQ41486VYCJGSYVF
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "53c5e1b6d139b8f8705d4bea0586f7a0-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 502
x-xss-protection: 1; mode=block

GET
H2 200 3462628496.json
www.perimeterx.com/page-data/sq/d/ Frame B287 769 B
857 B 47ms
43ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3462628496.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

dff1c95df1871fb00f4072de4333c7e4643c659dd8e8adbc746729eca62a98fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1G853B6F1TAT298KBW
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "5f673e298628b6aa8c6517044ffd13aa-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-length: 769
x-xss-protection: 1; mode=block

GET
H2 200 3662110850.json
www.perimeterx.com/page-data/sq/d/ Frame B287 524 B
614 B 48ms
45ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3662110850.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

28948159b803f5ff7f733581720bbae185968ee1f4f86dd3f2468902103d37fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1GS5D4KX8JHANBPENM
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "98041bd35c1bcc47320dc3c1e9c0dd49-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 524
x-xss-protection: 1; mode=block

GET
H2 200 3700775727.json
www.perimeterx.com/page-data/sq/d/ Frame B287 165 KB
35 KB 50ms
46ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3700775727.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

98d30c45ea79d9eae8bdcdce751eb747cefcc4a331df431ba7702ccd6cf44c9f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1GJY1SHQ07Y9WW26AK
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 35318
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "990e16b187a07900ab85daa87841c02e-ssl-df"
accept-ranges: bytes

GET
H2 200 3826888336.json
www.perimeterx.com/page-data/sq/d/ Frame B287 301 B
389 B 46ms
43ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/3826888336.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

dbc2a7f895d05be1b17ed8eb1eb609589ff3b3f9b3e2ee97f9a9e530f9026b75

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1HC3MDYBVEBA3SR9XK
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "cfeea2242f506b3b27a1a34666deb095-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-length: 301
x-xss-protection: 1; mode=block

GET
H2 200 56453587.json
www.perimeterx.com/page-data/sq/d/ Frame B287 48 KB
10 KB 48ms
45ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/sq/d/56453587.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

dc96c98b2419e72c35072ccb7d9b33b0aef45c2116eafc9c362b134db8c9b293

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1JA2NK33HCJSMP77GV
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 10395
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "c9f6a3c81dc4ce6ff33c406ca06ba9fc-ssl"
accept-ranges: bytes

GET
H2 200 app-data.json
www.perimeterx.com/page-data/ Frame B287 50 B
138 B 46ms
43ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/app-data.json

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

f051f186c88f8c27c42012b723552f3dda9ac61b295a0c2be0a58d15edd3bf68

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJ1JEGRGVVGADARGG2ED
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
x-content-type-options: nosniff
server: Netlify
age: 121
etag: "60f71c110a7379ea5aa020054de2e4f8-ssl"
x-frame-options: DENY
content-type: application/json
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:06:03 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 50
x-xss-protection: 1; mode=block

GET
H2 200 5c0649612297aae80121dbf87e1deedd440464f8.js Show response
d33wubrfki0l68.cloudfront.net/bundles/ Frame B287 958 KB
289 KB 47ms
13ms Script
application/javascript 18.66.242.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.242.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-242-175.dus51.r.cloudfront.net
Software: Netlify /
Resource Hash: 702396a93de43dacac67982c59314f5ae772e59e52a973027a31097e2143993b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G7Z8W504SJS3H8Y5MBVFD8T2
date: Thu, 14 Jul 2022 21:12:13 GMT
content-encoding: gzip
server: Netlify
age: 420951
etag: f335f77f37e1c390dde22f109c4e8897de1259b6-df
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31556926
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
x-amz-cf-id: 6GmVMgiLzhQrRKEWAp3J5YT7jOQYBYyp9frPGGBZEPHHFMBy3h-Byg==
via: 1.1 2b483ab832506bc86647b6ceba38dc9e.cloudfront.net (CloudFront)

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7m...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D48062%26time%3D1658254084167%26url%3Dhttps%253A%252F%252Fresources.perimeterx.com...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7m...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7...

0
265 B

189ms
155ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true&e_ipv6=AQLAAfPye5JYWQAAAYIXpUp3tI46zgeLSLkxdkQ8xUrxzl_T8GrCE1hAI8W4NSw5
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 1746ECE81A674240A08DF646B75BDC4C Ref B: FRAEDGE1119 Ref C: 2022-07-19T18:08:04Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLF2vnQ6rpKq9RmPRlA==
x-li-fabric: prod-ltx1

Redirect headers

date: Tue, 19 Jul 2022 18:08:03 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 987E56479C1D425BB893A68492A5FC75 Ref B: FRAEDGE1116 Ref C: 2022-07-19T18:08:04Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084167&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&liSync=true&e_ipv6=AQLAAfPye5JYWQAAAYIXpUp3tI46zgeLSLkxdkQ8xUrxzl_T8GrCE1hAI8W4NSw5
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLF2qohBkgG60HOmuiw==

GET
H2 200 740a51be-bd50-4765-b76c-0ee7167b128c.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/ 3 KB
2 KB 42ms
20ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/740a51be-bd50-4765-b76c-0ee7167b128c.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SLzrUuc5KrvzHsemRtbwmg==
age: 343
vary: Accept-Encoding
content-length: 1275
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:48 GMT
server: cloudflare
etag: 0x8D9E1BE63DB27A6
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c26ebfc1-001e-0170-7296-59ed77000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667a3cd4911f-FRA
expires: Tue, 19 Jul 2022 22:08:04 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js
https://s.adroll.com/j/exp/index.js

28 B
785 B

11ms
10ms

Script
application/javascript

2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: HTTP/1.1
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: ARc7DnguDTvPdHjwLfVxPM5gMAw12mfP
Via: 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront)
Etag: "5816cced8568d223aa09d889f300692b"
Age: 34077
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 28
Last-Modified: Wed, 15 Jun 2022 19:48:17 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:40:24 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 3h2ZxiB8GimclhTVbVw8CeubuIl0isKBMl9oKypVrOXtArw9oYIsKw==

Redirect headers

Date: Tue, 19 Jul 2022 09:24:04 GMT
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Age: 31439
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: JATM28AAcRHaqZ3ksBD1EfPF7hIoxyVTAtZ4-z4yRMM9JsFIppqSbA==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

9ms
9ms

Script
application/javascript

2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: HTTP/1.1
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 35203
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:21:54 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: b5PE49BaAn1UaN4QWMMLNjGROWIWOap_LMj5VwJaUelKvx5_F081gg==

Redirect headers

Date: Tue, 19 Jul 2022 14:02:57 GMT
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Age: 14706
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: _GBmcaHR7U4PmdD5IwUdbRHbhs9b1Nn3S1fczmDTu4fCjx0Cninbjw==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/ 0
809 B 30ms
13ms Script
text/javascript 2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/index.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: tzVexVo_CX.1u9K4aI1PdAmzfG6_5fBT
Via: 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 2864
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Sun, 17 Jul 2022 01:31:13 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 18:08:04 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: lm6CroYy5xokNrNPp7hzoeH8oT-qA2NSPozlBHaKkUV5Am2uFGxl6w==

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3964
date: Tue, 19 Jul 2022 17:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 19 Jul 2022 19:02:00 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.14.0/ 369 KB
82 KB 16ms
16ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7c129ee5de51a2692632d98e0e18cbc092fb758635921e4ecc404293495fafa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: bk+c/8JAdlTEAluR1Sm6dw==
age: 12948
vary: Accept-Encoding
content-length: 83472
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:15 GMT
server: cloudflare
etag: 0x8D8D8E82BC311EE
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3025cb95-001e-00fc-6cc0-11e679000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667aca37691f-FRA

POST
H/1.1 200
OK visitWebPage
001-vjx-104.mktoresp.com/webevents/ 2 B
318 B 606ms
151ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://001-vjx-104.mktoresp.com/webevents/visitWebPage?_mchNc=1658254084281&_mchCn=&_mchId=001-VJX-104&_mchTk=_mch-perimeterx.com-1658254084280-53925&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&_mchHo=resources.perimeterx.com&_mchPo=&_mchRu=%2Fnews-naturalfresh-magecart-analysis&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fmkto-sj130112.com%2F&_mchQp=utm_source%3Dmarketo__-__utm_medium%3Demail__-__utm_campaign%3Dnewsletter-july-2022__-__mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:04 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 4cd51d2d-90ce-4a1b-97fd-dec7a34d7643

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 14ms
13ms XHR
text/plain 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1182229276&t=pageview&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAAC~&jid=1942910324&gjid=509446709&cid=2128280482.1658254084&tid=UA-57261032-1&_gid=2034036128.1658254084&_r=1&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&cd10=null&cd11=null&cd12=null&z=1602540065

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
448 B 60ms
19ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-57261032-1&cid=2128280482.1658254084&jid=1942910324&gjid=509446709&_gid=2034036128.1658254084&_u=YADAAEAAQAAAAC~&z=1502120808

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 19 Jul 2022 18:08:04 GMT
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame B287 278 KB
86 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5ba0d3ba78227870d68d1c34d01566d9c3eb7019cf4b4f2f069abf100ad235cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87974
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:08:04 GMT

GET
H2 200 YDMIA7YLU5BMFL5TTCRXA7 Show response
d.adroll.com/consent/check/ 462 B
555 B 108ms
31ms Script
application/javascript 54.75.54.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/YDMIA7YLU5BMFL5TTCRXA7?arrfrr=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&_s=109287047cc7c41253cf7799db023c97&_b=2
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.54.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-54-75.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 5325b3a490261a2328311929382f65726b725a767a39332a1b228367528bb7c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
server: nginx/1.20.0
content-length: 462
content-type: application/javascript

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/ 75 KB
17 KB 22ms
21ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/en.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec3783a450dbbff3e5c15673dc8ff4348cb71b818c43c18cb8e19bbe236c45fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: +IDd5yKFHYCANhs1gb1cEw==
age: 31
vary: Accept-Encoding
content-length: 16729
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:49 GMT
server: cloudflare
etag: 0x8D9E1BE646C7C71
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 8c694aba-101e-0146-4c96-594025000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667b2e6c911f-FRA
expires: Tue, 19 Jul 2022 22:08:04 GMT

GET
H2 200 link-arrow.svg
d33wubrfki0l68.cloudfront.net/25989c27cb9af33a5d7c4724e2e4a792eae54f44/92274/icons/ Frame B287 672 B
1 KB 37ms
28ms Image
image/svg+xml 18.66.242.175
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d33wubrfki0l68.cloudfront.net/25989c27cb9af33a5d7c4724e2e4a792eae54f44/92274/icons/link-arrow.svg
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.242.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-242-175.dus51.r.cloudfront.net
Software: Netlify /
Resource Hash: eb5587a924cd997ae5ab4896d812257c47dae81e2b9b7a0a049b78cf32793968

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G3G3RFEDS44SZ4WF6V4P76QF
date: Fri, 20 May 2022 06:51:26 GMT
via: 1.1 2b483ab832506bc86647b6ceba38dc9e.cloudfront.net (CloudFront)
server: Netlify
age: 5224598
etag: 59d8b67ba0445b4d74ac97fd4c4278d1c3fbac16
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31556926
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
content-length: 672
x-amz-cf-id: ErBw_2ztJ10nWEPQhIvDUwZ9bnH1kl0GU9MsMigsGeZXdhczxhwZEQ==

GET
H2 200 campfire_fkupmf.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657301254/tech-blog/2022/boosting-up-json-performance/ Frame B287 20 KB
20 KB 81ms
9ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657301254/tech-blog/2022/boosting-up-json-performance/campfire_fkupmf.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

71cb5ad3dbda534886cdfb1980a588e3914a71a87e7e517df63c1abac8227772

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="campfire_fkupmf.webp"
server-timing: fastly;dur=2;cpu=1;start=2022-07-19T18:08:04.426Z;desc=hit,rtt;dur=6
vary: DPR,Width
content-length: 20106
last-modified: Fri, 08 Jul 2022 18:30:16 GMT
server: Cloudinary
etag: "95b0f7445b106a41d95160d32e73d540"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 blog-2557x1441-deobfuscation_yrwwvq.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657055704/tech-blog/2022/skimmer-deobfuscation/ Frame B287 12 KB
12 KB 83ms
11ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1657055704/tech-blog/2022/skimmer-deobfuscation/blog-2557x1441-deobfuscation_yrwwvq.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

74f060fcb905d2e08f7adfba7ced8546345547ef52be4edd16b2010a1e7aada3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="blog-2557x1441-deobfuscation_yrwwvq.webp"
server-timing: fastly;dur=2;cpu=1;start=2022-07-19T18:08:04.426Z;desc=hit,rtt;dur=6
vary: DPR,Width
content-length: 12428
last-modified: Wed, 06 Jul 2022 17:43:55 GMT
server: Cloudinary
etag: "41e6e401661379742f5bb83debe72e33"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 blog-2557x1441-anti-virtual-machine-skimming_r1nija.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1655921228/tech-blog/2022/anti-vm/ Frame B287 13 KB
13 KB 87ms
16ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_auto:100:400//v1655921228/tech-blog/2022/anti-vm/blog-2557x1441-anti-virtual-machine-skimming_r1nija.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

e0ccd9072d23576c5e88acb4159d67dc4ce03d298e32b2fc51b91bc71ba5d56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="blog-2557x1441-anti-virtual-machine-skimming_r1nija.webp"
server-timing: fastly;dur=8;cpu=1;start=2022-07-19T18:08:04.426Z;desc=hit,rtt;dur=6
vary: DPR,Width
content-length: 13002
last-modified: Wed, 22 Jun 2022 22:48:26 GMT
server: Cloudinary
etag: "6c07846290da0a7db3b1ff025e58b8bf"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ Frame B287 44 KB
44 KB 54ms
21ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 18 Jul 2022 23:10:25 GMT
x-content-type-options: nosniff
age: 68259
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 Jul 2023 23:10:25 GMT

GET
H2 200 7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame B287 20 KB
21 KB 42ms
9ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 12 Jul 2022 22:25:48 GMT
x-content-type-options: nosniff
age: 589336
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20960
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:18:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Jul 2023 22:25:48 GMT

GET
H2 200 7cHqv4kjgoGqM7E3t-4s51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame B287 21 KB
21 KB 45ms
13ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3t-4s51os.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Barlow:400,500,700|Barlow+Condensed:300,600|Open+Sans:400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 12 Jul 2022 22:25:37 GMT
x-content-type-options: nosniff
age: 589347
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21724
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Jul 2023 22:25:37 GMT

GET
H2 200 blog-2557x1441-magecart-mallrats_ntdyhn.png
assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_820//v1651174863/tech-blog/2022/mallrats-magecart/ Frame B287 22 KB
23 KB 159ms
136ms Image
image/webp 2a04:4e42:600::604
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.perimeterx.com/image/upload/dpr_auto,f_auto,w_820//v1651174863/tech-blog/2022/mallrats-magecart/blog-2557x1441-magecart-mallrats_ntdyhn.png

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::604 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

f3a589d619416bd674e0fdbcc22738e611b488dde2167be30ec00886ec475ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
content-disposition: inline; filename="blog-2557x1441-magecart-mallrats_ntdyhn.webp"
server-timing: fastly;dur=126;cpu=1;start=2022-07-19T18:08:04.426Z;desc=miss,rtt;dur=6,cloudinary;dur=24;start=2022-07-19T18:08:04.476Z
vary: DPR
content-length: 22970
last-modified: Fri, 29 Apr 2022 14:32:29 GMT
server: Cloudinary
etag: "4d974f5acf70936822e36d8f65b1254f"
strict-transport-security: max-age=604800
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=31557600
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 60ms
33ms Image
image/gif 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-57261032-1&cid=2128280482.1658254084&jid=1942910324&_u=YADAAEAAQAAAAC~&z=1006649335

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 59ms
33ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-57261032-1&cid=2128280482.1658254084&jid=1942910324&_u=YADAAEAAQAAAAC~&z=1006649335

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 29ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26001
x-xss-protection: 0
pragma: public
x-fb-debug: WM32GgvA7ywp68E6AnvNq2aVfwGbxqqXtxOLcPOITdpMiEvn2O0cP91m4VI7GqH9MfuGxVv255PzDteXDJYmqw==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:04 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ 683 KB
183 KB 8ms
8ms Script
text/javascript 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93f2e0ec5bdac100d5c45192320aeae54aefd4e34064773d281ccad99ca2777a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 01:04:24 GMT
server: AmazonS3
age: 29965
etag: W/"b1d1c4c410ccb107d04dafa6f2d7f492"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Tue, 19 Jul 2022 09:48:40 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: 0RE3BVFzYU66cUwPPnBOWCSup0Ta0jQ8JZ2MYDwgjbuWIsm3keWFqA==

GET
H2 200 w.js Show response
d10lpsik1i8c69.cloudfront.net/ 5 KB
3 KB 42ms
8ms Script
application/javascript 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:57:17 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:53 GMT
server: AmazonS3
age: 648
etag: W/"eb0a40c00c97d9640177205882172295"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: ag4E4oYu0k9QAmIgJXdZgjnr0D34Aw6EmkM3-SPengIbwYGSwq_-0Q==

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/ 12 KB
3 KB 25ms
23ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/otFlat.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

868f2732413f5fcb021d726343ac249b6ca630db5fbd578f6525f279dda5c22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: BkZngIV1hzEthgbkouRUbA==
age: 30
vary: Accept-Encoding
content-length: 2832
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:04 GMT
server: cloudflare
etag: 0x8D8D8E825563082
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 90491bdc-701e-00da-2c96-597dcd000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667befaa911f-FRA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/ 47 KB
12 KB 22ms
21ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/otPcCenter.json

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5de3651c0aa89e6497da505565c8944039fd6480aa161b1f270d1f5953c9d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 8jNYupXcL2bcdab+1R7CAg==
age: 31
vary: Accept-Encoding
content-length: 11511
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:07 GMT
server: cloudflare
etag: 0x8D8D8E827001198
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: a0508b34-801e-0065-2596-5969bb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667befad911f-FRA

GET
H2 200 lftracker_v1_9mDnrdyX0ng1KXMv.js Show response
lftracker.leadfeeder.com/ 29 KB
11 KB 81ms
31ms Script
application/javascript 18.64.103.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_9mDnrdyX0ng1KXMv.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-56.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 139fc90823b96a757bba2c141df7fa3811af648b70cd294723a3dbb47cb13b1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: _vGDpzyT8SqbIqKQjJGReZGviOfU8A69
content-encoding: gzip
last-modified: Mon, 27 Jun 2022 07:03:30 GMT
server: AmazonS3
age: 3283
etag: W/"c6baef4235444eeb7c09f78f14e761e2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 3ffa21fde24be18d36c5d5b13a622abe.cloudfront.net (CloudFront)
cache-control: max-age=3600
date: Tue, 19 Jul 2022 18:08:04 GMT
x-amz-cf-pop: TXL50-P3
x-amz-cf-id: s_iIH5V6eQCvR9JSXTUx11bLz39Te5iejA9Sktd0MIemnAi7sg576g==

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ Frame B287 8 KB
3 KB 9ms
8ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80368
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ Frame B287 1 KB
1 KB 7ms
7ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:04 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ Frame B287 20 KB
7 KB 13ms
13ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 4m3LBpuQ5au3un+sbdTm6g==
age: 1446
vary: Accept-Encoding
content-length: 6922
x-ms-lease-status: unlocked
last-modified: Thu, 14 Jul 2022 19:31:29 GMT
server: cloudflare
etag: 0x8DA65CF736BBFE4
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 32dfe822-301e-0115-48e4-975c2a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667c6cbb691f-FRA

GET
H3 200 iframe_api Show response
www.youtube.com/ Frame B287 980 B
515 B 29ms
26ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fe3cdb6342633b630a1636d3a83f1beb1aa5a9404078a93618f3235f4d609f6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Tue, 19 Jul 2022 18:08:04 GMT

GET
H2 200 4607.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ Frame B287 16 B
236 B 121ms
119ms Script
text/javascript 2606:4700:4400::ac40:97c9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/4607.js?p=https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/&e=

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:97c9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
x-request-id: df2260b5-fb41-4330-8946-0f8335369aab
x-runtime: 0.003140
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=604800
x-download-options: noopen
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray: 72d5667c7d2b9a06-FRA

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ Frame B287 52 KB
17 KB 11ms
9ms Script
text/javascript 2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: J7p8W1lQgNY91qwUxZU3x.y9IQrTVjMu
Content-Encoding: gzip
Etag: W/"d570d2e0cc47679b5bf3a6f9ff5b9e5b"
Age: 2066
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Via: 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront)
Last-Modified: Thu, 30 Jun 2022 21:03:48 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 17:33:38 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: Cz6bO0M_BpSMNfwVIk_U6GR8SLMe-ffI1MlrKuA61nUW2FE1dmCguw==

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80368
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H3 200 368880343933228 Show response
connect.facebook.net/signals/config/ 291 KB
84 KB 21ms
10ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/368880343933228?v=2.9.65&r=stable

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

28e696f1e4297a65c928a3c82a163d9eacba8bea8725beea0b8aa2470dc88248

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85605
x-xss-protection: 0
pragma: public
x-fb-debug: 28bi4pEHCdmTl7E99Bk630VkkqRt3tnlNUrDueNXHxvdQ4mvq5nlEQKGWp7EM9ti255bO9YzDR3EKj+t91Sz3w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:04 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
settings.luckyorange.net/ 3 KB
2 KB 155ms
122ms Fetch
application/json 172.67.75.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://settings.luckyorange.net/?u=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&s=84276

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.75.100 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

863b0cb9d113013dae9dfced36761ed6de7d79632add96d70c8f2f2571f3e5e6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://resources.perimeterx.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h66JGngwmMvhWD7th2%2BLuCAFEz7rlg2UF8iFFCT3Jl6CaEHn0EBowpV%2BZTCQ%2BDS2vleQXLDcMqq9dzZl2UhUwW4bxW%2BaaXB5RzXwzqtF3GNfHrFI%2FyIMCGQcurWu%2BRvXzhnKhx7iT4R3gQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 72d5667d2f6b9ba4-FRA
access-control-allow-headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since

GET
H2

200

collect
px4.ads.linkedin.com/ Frame B287
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084680&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7m...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084680&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7...

0
143 B

174ms
163ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084680&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&e_ipv6=AQJ-hF41u8dRXQAAAYIXpUqcWFsX6DVj5LZiRnAsapZmOU5JgIX8hAwieYR3Hu04
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: E4F8DCF3CD03463A843044F13A0AFD1E Ref B: FRAEDGE1119 Ref C: 2022-07-19T18:08:04Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLF2vndq7OXyjWjeyhA==
x-li-fabric: prod-ltx1

Redirect headers

date: Tue, 19 Jul 2022 18:08:03 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 31FFBE2A6FDD414DB5E36EA54831A109 Ref B: FRAEDGE1116 Ref C: 2022-07-19T18:08:04Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=48062&time=1658254084680&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Fmkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0%26utm_campaign%3Dnewsletter-july-2022%26utm_source%3Dmarketo%26utm_medium%3Demail&e_ipv6=AQJ-hF41u8dRXQAAAYIXpUqcWFsX6DVj5LZiRnAsapZmOU5JgIX8hAwieYR3Hu04
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXkLF2rO8JUIOPWImvTXA==

GET
H2 204 init Show response
jukebox.pathfactory.com/api/public/v1/ 0
738 B 120ms
119ms XHR
text/plain 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/init?image=&title=&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&clientId=LB-FE20E0D4-10557

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.015830
date: Tue, 19 Jul 2022 18:08:04 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-request-id: 12e0d2a4-bc84-4cf7-8aef-eb50fe768970

GET
H2 200 740a51be-bd50-4765-b76c-0ee7167b128c.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/ Frame B287 3 KB
1 KB 17ms
16ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/740a51be-bd50-4765-b76c-0ee7167b128c.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SLzrUuc5KrvzHsemRtbwmg==
age: 6035
vary: Accept-Encoding
content-length: 1275
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:48 GMT
server: cloudflare
etag: 0x8D9E1BE63DB27A6
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7a8abd34-101e-00e8-4160-2d251d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667dcb7a911f-FRA
expires: Tue, 19 Jul 2022 22:08:04 GMT

GET
H2 200 /
tr.lfeeder.com/ 43 B
292 B 109ms
62ms Image
image/gif 143.204.89.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiMjEyODI4MDQ4Mi4xNjU4MjU0MDg0Il0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNTAuMSJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly9yZXNvdXJjZXMucGVyaW1ldGVyeC5jb20vbmV3cy1uYXR1cmFsZnJlc2gtbWFnZWNhcnQtYW5hbHlzaXM/dXRtX3NvdXJjZT1tYXJrZXRvJnV0bV9tZWRpdW09ZW1haWwmdXRtX2NhbXBhaWduPW5ld3NsZXR0ZXItanVseS0yMDIyJm1rdF90b2s9TURBeExWWktXQzB4TURRQUFBR0Z0cGk5RHg3bWVvS1ZOeGlncTJ6cWg3ZVlLb0dSb3pXUnVYR0RSQ2J2d1ZDeUVJQ0dOQ1RmRS1VY0I4UXJxVWdISHpzTi1GNTRnTk53V2otdV8xbWRob3RNdl85VFFjbUJDNGRLUjBYQmlnMCIsInBhZ2VUaXRsZSI6IkFuIEFuYWx5c2lzIG9mIHRoZSBOYXR1cmFsIEZyZXNoIE1hbGwgTWFnZWNhcnQgQXR0YWNrIiwicmVmZXJyZXIiOiJodHRwczovL21rdG8tc2oxMzAxMTIuY29tLyJ9LCJldmVudCI6InRyYWNraW5nLWV2ZW50IiwiY2xpZW50RXZlbnRJZCI6IjYzOTVkODcxMjQ2ZjI5MmYiLCJzY3JpcHRJZCI6IjltRG5yZHlYMG5nMUtYTXYiLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiY29uc2VudExldmVsIjoibm9uZSIsImFub255bWl6ZUlwIjpmYWxzZSwibGZDbGllbnRJZCI6IkxGMS4xLmI1NzQ0Yzc1ZWJiOTEyZjkuMTY1ODI1NDA4NDc2NSIsImZvcmVpZ25Db29raWVzIjpbXSwicHJvcGVydGllcyI6e30sImF1dG9UcmFja2luZ0VuYWJsZWQiOnRydWUsImF1dG9UcmFja2luZ01vZGUiOiJvbl9zY3JpcHRfbG9hZCJ9
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-97.fra50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA50-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: O9dSDFMQwd5ciHn3sCf7li2amxDqo_NuU0xFtNfiJIhbUzHmr0TwKA==

GET
H2 200 /
tr.lfeeder.com/ 43 B
293 B 76ms
35ms Image
image/gif 143.204.89.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiMjEyODI4MDQ4Mi4xNjU4MjU0MDg0Il0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNTAuMSJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly9yZXNvdXJjZXMucGVyaW1ldGVyeC5jb20vbmV3cy1uYXR1cmFsZnJlc2gtbWFnZWNhcnQtYW5hbHlzaXM/dXRtX3NvdXJjZT1tYXJrZXRvJnV0bV9tZWRpdW09ZW1haWwmdXRtX2NhbXBhaWduPW5ld3NsZXR0ZXItanVseS0yMDIyJm1rdF90b2s9TURBeExWWktXQzB4TURRQUFBR0Z0cGk5RHg3bWVvS1ZOeGlncTJ6cWg3ZVlLb0dSb3pXUnVYR0RSQ2J2d1ZDeUVJQ0dOQ1RmRS1VY0I4UXJxVWdISHpzTi1GNTRnTk53V2otdV8xbWRob3RNdl85VFFjbUJDNGRLUjBYQmlnMCIsInBhZ2VUaXRsZSI6IkFuIEFuYWx5c2lzIG9mIHRoZSBOYXR1cmFsIEZyZXNoIE1hbGwgTWFnZWNhcnQgQXR0YWNrIiwicmVmZXJyZXIiOiJodHRwczovL21rdG8tc2oxMzAxMTIuY29tLyJ9LCJldmVudCI6InRyYWNraW5nLWV2ZW50IiwiY2xpZW50RXZlbnRJZCI6IjE2ZDU1YzRhNGEzNmUzY2MiLCJzY3JpcHRJZCI6IjltRG5yZHlYMG5nMUtYTXYiLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiY29uc2VudExldmVsIjoibm9uZSIsImFub255bWl6ZUlwIjpmYWxzZSwibGZDbGllbnRJZCI6IkxGMS4xLmI1NzQ0Yzc1ZWJiOTEyZjkuMTY1ODI1NDA4NDc2NSIsImZvcmVpZ25Db29raWVzIjpbXSwicHJvcGVydGllcyI6e30sImF1dG9UcmFja2luZ0VuYWJsZWQiOnRydWUsImF1dG9UcmFja2luZ01vZGUiOiJvbl9zY3JpcHRfbG9hZCJ9
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-97.fra50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA50-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: Tc1feDHNtxOWBs6S4AXbvoXrDHzJVlunTiDnE2dspUijWLy3drq1rg==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/ Frame B287
Redirect Chain

https://s.adroll.com/j/exp/YDMIA7YLU5BMFL5TTCRXA7/index.js
https://s.adroll.com/j/exp/index.js

28 B
785 B

14ms
13ms

Script
application/javascript

2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: HTTP/1.1
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: ARc7DnguDTvPdHjwLfVxPM5gMAw12mfP
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Etag: "5816cced8568d223aa09d889f300692b"
Age: 34078
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 28
Last-Modified: Wed, 15 Jun 2022 19:48:17 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:40:23 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: kLtSXV_U0p6YyGSIsJ2J2qpfJOBYNOmBPvr_F1tDkcxdivNAXKORzA==

Redirect headers

Date: Tue, 19 Jul 2022 09:24:04 GMT
Via: 1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront)
Age: 31439
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: KQwarhvk0iRlJR2ZtQwYOGdp32quLK1PENdA8DcPd77LuoYPiF5NbQ==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/ Frame B287
Redirect Chain

https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

13ms
13ms

Script
application/javascript

2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: HTTP/1.1
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 35204
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 08:21:54 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: KifwQO6PDJ8_1VFOUpAGc4VJDUiPvh1dXqwvzaqQJ71peblj1m80cA==

Redirect headers

Date: Tue, 19 Jul 2022 14:02:57 GMT
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Age: 14706
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: Uhu0OUBQJwU_mLUcsZ8ZKuCcZyfGcYRu2hxjcYOhVWc-1u9uHoPmuw==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/ Frame B287 0
809 B 12ms
12ms Script
text/javascript 2600:9000:2156:9000:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/YDMIA7YLU5BMFL5TTCRXA7/YJQFMCNONVBU3GUCROIR7B/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9000:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

X-Amz-Version-Id: tzVexVo_CX.1u9K4aI1PdAmzfG6_5fBT
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Age: 2864
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 0
Last-Modified: Sun, 17 Jul 2022 01:31:13 GMT
Server: AmazonS3
Date: Tue, 19 Jul 2022 18:08:04 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: 1gHV1_Lj9xSlE9wg90N2-3TWWdhhhoWyFhtl-vb237nuAQnLWezjJg==

OPTIONS
H2 200 init
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 101ms
100ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/init?image=&title=&url=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&clientId=LB-FE20E0D4-10557
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:08:04 GMT

OPTIONS
H2 200 create_event
jukebox.pathfactory.com/api/public/v1/page_views/ Frame 0
0 97ms
97ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views/create_event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:08:04 GMT

OPTIONS
H2 200 create_event
jukebox.pathfactory.com/api/public/v1/page_views/ Frame 0
0 100ms
100ms Preflight 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/page_views/create_event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-82-195-36.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
access-control-max-age: 7200
date: Tue, 19 Jul 2022 18:08:04 GMT

POST
H2 204 create_event Show response
jukebox.pathfactory.com/api/public/v1/page_views/ 0
740 B 120ms
119ms XHR
text/plain 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views/create_event

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.016536
date: Tue, 19 Jul 2022 18:08:04 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-request-id: 2d61bba5-7240-4d4e-9220-0dd66b0a8699

POST
H2 204 create_event Show response
jukebox.pathfactory.com/api/public/v1/page_views/ 0
736 B 114ms
114ms XHR
text/plain 54.82.195.36
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/page_views/create_event

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.82.195.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-82-195-36.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.013439
date: Tue, 19 Jul 2022 18:08:04 GMT
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
x-content-type-options: nosniff
x-request-id: e7f64036-2f6f-4acd-923e-382ed512fa8b

GET
H2 200 8cf9b171-c565-4071-9447-9567cebc44e4.png
cdn.pathfactory.com/assets/10557/thumbnails/371592/ 51 KB
51 KB 480ms
430ms Image
image/png 18.66.248.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.pathfactory.com/assets/10557/thumbnails/371592/8cf9b171-c565-4071-9447-9567cebc44e4.png
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-127.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 91892af76d8bc88bb779fb1b99ae8d9a9a84d0ffa2b27c2ebf8c35b4ab3a0c83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 19 Jul 2022 18:08:06 GMT
via: 1.1 2c4f54cad5da50a372b086710d5ffc62.cloudfront.net (CloudFront)
last-modified: Mon, 09 Aug 2021 14:48:16 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "d42ce3a856a78f0e34085bba7bb30f1a"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: image/png
cache-control: max-age=60, must-revalidate
accept-ranges: bytes
content-length: 52106
x-amz-cf-id: J6MGUwAIc2JwbLkkMiO31vqZmULa8Lb3L2qXkD6TE4ROKsqqIr5htw==

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/ 69 KB
70 KB 37ms
22ms Font
font/woff2 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/fonts/fontawesome-webfont.woff2?v=4.6.1

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Origin: https://resources.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 756
age: 57376
cdn-proxyver: 1.02
cdn-cachedat: 06/09/2022 01:10:16
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70728
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
etag: "926c93d201fe51c8f351e858468980c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 6a524c4fee4af879369f6dea54294667
accept-ranges: bytes
cf-ray: 72d5667e4c469948-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 page-data.json
www.perimeterx.com/page-data/tech-blog/ben-baryo/ Frame B287 0
2 KB 152ms
151ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/ben-baryo/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJQ4JA08KBW25WFQ7FAY
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2044
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:04 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ee9c3749812a78d8fe99e3bbcb975600-ssl-df"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/tech-blog/ Frame B287 0
1 KB 140ms
139ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJQ48FCD5F78D6CA4TCF
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 1385
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:04 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "2be118ba3742a3c31d1549725a303aa7-ssl-df"
accept-ranges: bytes

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame B287 213 KB
72 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S5CWZF51H2&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

866fd0f98742f8922ccca3f48c527a43f7106544bc1831f8cb514d0e39200b57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74015
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:08:04 GMT

GET
H3 200 optimize.js Show response
www.google-analytics.com/gtm/ Frame B287 117 KB
44 KB 33ms
33ms Script
application/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-PCDTQ25

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e49758209fb3df872d02169e1701d2a9ad52d687b41f99d9c3de3ef81304f867

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45245
x-xss-protection: 0
expires: Tue, 19 Jul 2022 18:08:04 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ Frame B287 8 KB
3 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=80368
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H2 200 k1S0pNhzdwg3y5l6uOk0 Show response
ws.zoominfo.com/pixel/ Frame B287 3 KB
2 KB 202ms
173ms Script
text/javascript 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/k1S0pNhzdwg3y5l6uOk0

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

3afa935fb4eb58a3b6bd770368e79d91f7716722bc9d8c942a5495a27f33206c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 72d5667e6a84916e-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
via: 1.1 google

GET
H/1.1 204
No Content / Show response
api9130.d41.co/sync/ Frame B287 0
510 B 438ms
105ms Script
text/plain 54.81.167.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api9130.d41.co/sync/

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.81.167.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-81-167-22.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:05 GMT
Referrer-Policy: no-referrer-when-downgrade
Expect-CT: max-age=30, report-uri="https://a54b4ab95d40a8b116fae47033b75682.report-uri.com/r/d/ct/reportOnly"
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
access-control-allow-origin: https://www.perimeterx.com
Cache-control: no-store
access-control-allow-credentials: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK cnv
cnv.event.prod.bidr.io/log/ Frame B287 43 B
430 B 44ms
44ms Image
image/gif 54.220.8.206
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=83&buzz_key=intentsify&value=&segment_key=&account_id=2&order=[ORDER]&ord=928070916

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.220.8.206 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-220-8-206.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:04 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
attr.ml-api.io/ Frame B287
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

0
242 B

462ms
460ms

Image
application/json

2600:9000:2156:8e00:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Server: 2600:9000:2156:8e00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
apigw-requestid: Vhro6gudoAMESBQ=
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: KkkIaFeMmIl5d1cnXPajMpLV8sQO6S19hKZjiIgFFJQWF4GixlVTDA==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:05 GMT
X-Proxy-Origin: 81.95.5.43; 81.95.5.43; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 20d71744-7da9-438c-b5ca-a074e92a4345
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/ Frame B287 159 KB
51 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9504bca9/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0da1fc9c1b23d76d5b0f9d3154f4141b30a6926b68523c37ec483dd0200945a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:18:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2978
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52491
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 00:14:55 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 19 Jul 2023 17:18:26 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ Frame B287 11 KB
5 KB 12ms
11ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Thu, 27 Oct 2022 18:08:04 GMT

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 18 B
35 B 43ms
28ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 1066c86165eb47cacbc55a34aa66bae28955f7deed5926249030f98b70af8031

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:08:03 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/740a51be-bd50-4765-b76c-0ee7167b128c.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SLzrUuc5KrvzHsemRtbwmg==
age: 6035
vary: Accept-Encoding
content-length: 1275
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:48 GMT
server: cloudflare
etag: 0x8D9E1BE63DB27A6
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7a8abd34-101e-00e8-4160-2d251d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667efd99911f-FRA
expires: Tue, 19 Jul 2022 22:08:04 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 30ms
8ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=368880343933228&ev=PageView&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&rl=https%3A%2F%2Fmkto-sj130112.com%2F&if=false&ts=1658254084981&sw=1600&sh=1200&v=2.9.65&r=stable&ec=0&o=30&fbp=fb.1.1658254084978.1235718807&it=1658254084632&coo=false&exp=u0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Tue, 19 Jul 2022 18:08:05 GMT

GET
H2 200 YDMIA7YLU5BMFL5TTCRXA7 Show response
d.adroll.com/consent/check/ Frame B287 462 B
554 B 31ms
29ms Script
application/javascript 54.75.54.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/YDMIA7YLU5BMFL5TTCRXA7?arrfrr=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&_s=1389a150116323a513306ca610d0e887&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.54.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-54-75.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 5325b3a490261a2328311929382f65726b725a767a39332a1b228367528bb7c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
server: nginx/1.20.0
content-length: 462
content-type: application/javascript

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame B287 98 KB
25 KB 11ms
11ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26001
x-xss-protection: 0
pragma: public
x-fb-debug: YAXTWPA4daOLaMNW840YAioqNX+Rg+HX4tRlAzwywGFyUgzUucTLDLMQFpj6JiKJRKD2ci5hy6dwsWhkjR4RGw==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:05 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ Frame B287 683 KB
183 KB 9ms
9ms Script
text/javascript 13.32.99.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-99.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93f2e0ec5bdac100d5c45192320aeae54aefd4e34064773d281ccad99ca2777a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 01:04:24 GMT
server: AmazonS3
age: 29966
etag: W/"b1d1c4c410ccb107d04dafa6f2d7f492"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
cache-control: max-age=43200
date: Tue, 19 Jul 2022 09:48:40 GMT
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: GKpBGSQXezUL1L0nFXNbUrHCWg1QWiZl42BOw7_KH-SJ6vYLgxp2oA==

GET
H2 200 w.js Show response
d10lpsik1i8c69.cloudfront.net/ Frame B287 5 KB
3 KB 14ms
10ms Script
application/javascript 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 17:57:17 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:53 GMT
server: AmazonS3
age: 649
etag: W/"eb0a40c00c97d9640177205882172295"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: Z8_5C9D20ggB5YGw6CP6Jtv1KbvBabF3Ug1GzLsii1kOB57s-6nNuw==

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.14.0/ Frame B287 369 KB
82 KB 23ms
22ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7c129ee5de51a2692632d98e0e18cbc092fb758635921e4ecc404293495fafa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: bk+c/8JAdlTEAluR1Sm6dw==
age: 12949
vary: Accept-Encoding
content-length: 83472
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:15 GMT
server: cloudflare
etag: 0x8D8D8E82BC311EE
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3025cb95-001e-00fc-6cc0-11e679000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d5667f48e8691f-FRA

GET
H2 200 clickstream.js Show response
d10lpsik1i8c69.cloudfront.net/js/ Frame 5620 287 KB
93 KB 30ms
12ms Script
application/javascript 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8

Request headers

Referer
Origin: https://resources.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:07:50 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 16
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
etag: W/"16e967413dfa0346be281513c77581b9"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 d55780b776b171387055eca956ae29a8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: -4ng4VRu06gSQF-Dx61hYh2zmxhJC8X3STT_jyplxA4rclVi6tOvCQ==

GET
H2 200 px-tech-blog.svg
www.perimeterx.com/logos/ Frame B287 26 KB
10 KB 159ms
158ms Image
image/svg+xml 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.perimeterx.com/logos/px-tech-blog.svg

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

c4191bdf74ac201d8071060b64d19ec9d284ee7512d5a08ecef16d99b787b9d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJYNYQCDZECEN9GAFW0F
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
server: Netlify
age: 0
x-frame-options: DENY
etag: "d0e65f22b30f953aa748974953adbe60-ssl-df"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0, must-revalidate
date: Tue, 19 Jul 2022 18:08:05 GMT
strict-transport-security: max-age=31536000
accept-ranges: bytes
x-xss-protection: 1; mode=block

GET
H2 200 lftracker_v1_9mDnrdyX0ng1KXMv.js Show response
lftracker.leadfeeder.com/ Frame B287 29 KB
11 KB 17ms
16ms Script
application/javascript 18.64.103.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_9mDnrdyX0ng1KXMv.js
Requested by: Host: mkto-sj130112.com
URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.103.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-103-56.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 139fc90823b96a757bba2c141df7fa3811af648b70cd294723a3dbb47cb13b1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: _vGDpzyT8SqbIqKQjJGReZGviOfU8A69
content-encoding: gzip
last-modified: Mon, 27 Jun 2022 07:03:30 GMT
server: AmazonS3
age: 3284
etag: W/"c6baef4235444eeb7c09f78f14e761e2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 3ffa21fde24be18d36c5d5b13a622abe.cloudfront.net (CloudFront)
cache-control: max-age=3600
date: Tue, 19 Jul 2022 18:08:04 GMT
x-amz-cf-pop: TXL50-P3
x-amz-cf-id: NpM6DsxBs6SZPu6_4Doa7yUPyKtZB2ikcGHecR7yzen_fEWhTzUzPw==

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/tech-blog/ Frame B287 3 KB
1 KB 12ms
11ms XHR
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

7724bf5c171c673ab3f574e6e6c3921668326904a0aa564d519c0e33e4d5b2f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJZ2KTY9M3P5504ABGAZ
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 1
vary: Accept-Encoding
content-length: 1385
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:04 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "2be118ba3742a3c31d1549725a303aa7-ssl-df"
accept-ranges: bytes

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/tech-blog/ben-baryo/ Frame B287 6 KB
2 KB 22ms
22ms XHR
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/tech-blog/ben-baryo/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

0088c55fcbe4ccb2df59204288cece3aedac3efce32493bea627d68466148e2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAJZ28XW00ZVR2FP6Z5TY
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 1
vary: Accept-Encoding
content-length: 2044
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:04 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ee9c3749812a78d8fe99e3bbcb975600-ssl-df"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/index/ Frame B287 0
4 KB 13ms
12ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/index/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAK03YSKR5C7YK4CYZP1P
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 4037
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:04 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "96a5816c2bd86b34e3406cf142521d91-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json
www.perimeterx.com/page-data/about/careers/ Frame B287 0
3 KB 131ms
131ms Other
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/about/careers/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAK05QTYK708JQ3J1XJV3
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2755
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:05 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ed3082f91f15dff29f043d6f338fe620-ssl"
accept-ranges: bytes

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame B287 49 KB
20 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3965
date: Tue, 19 Jul 2022 17:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 19 Jul 2022 19:02:00 GMT

POST
H/1.1 200
OK visitWebPage
001-vjx-104.mktoresp.com/webevents/ Frame B287 2 B
318 B 156ms
155ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://001-vjx-104.mktoresp.com/webevents/visitWebPage?_mchNc=1658254085192&_mchCn=&_mchId=001-VJX-104&_mchTk=_mch-perimeterx.com-1658254084280-53925&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&_mchHo=www.perimeterx.com&_mchPo=&_mchRu=%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:08:05 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: a2166aaf-0a62-4b87-a056-e01967362862

GET
H3 200 368880343933228 Show response
connect.facebook.net/signals/config/ Frame B287 291 KB
84 KB 10ms
10ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/368880343933228?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

28e696f1e4297a65c928a3c82a163d9eacba8bea8725beea0b8aa2470dc88248

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85605
x-xss-protection: 0
pragma: public
x-fb-debug: 28bi4pEHCdmTl7E99Bk630VkkqRt3tnlNUrDueNXHxvdQ4mvq5nlEQKGWp7EM9ti255bO9YzDR3EKj+t91Sz3w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:05 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
settings.luckyorange.net/ Frame B287 3 KB
1 KB 133ms
133ms Fetch
application/json 172.67.75.100
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://settings.luckyorange.net/?u=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&s=84276

Requested by

Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.75.100 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2aeded44549c79579a1c22df5540256a9508410e5d1640fd20eb7cf8a0e65b2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.perimeterx.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VhmfrIDVC%2F12FRDXT%2FNXWEC4Bv7PykT2nGacICC2zPX3GmTR53qCR8HjuWQ1EwC3jhZM%2FKhibLZm39yAiV6q2ELKWR18heFyds811YZcXvhE%2FP4tUJvAFbGU55XDf8b1UUhYUBqMyS9leg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 72d56680ae289ba4-FRA
access-control-allow-headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/ Frame B287 75 KB
16 KB 20ms
20ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/740a51be-bd50-4765-b76c-0ee7167b128c/7db516e1-b839-4652-9f03-4ca7c9545199/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec3783a450dbbff3e5c15673dc8ff4348cb71b818c43c18cb8e19bbe236c45fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: +IDd5yKFHYCANhs1gb1cEw==
age: 6036
vary: Accept-Encoding
content-length: 16729
x-ms-lease-status: unlocked
last-modified: Thu, 27 Jan 2022 17:56:49 GMT
server: cloudflare
etag: 0x8D9E1BE646C7C71
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 48776c1f-001e-0091-2c48-574c57000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56680d911911f-FRA
expires: Tue, 19 Jul 2022 22:08:05 GMT

GET
H2 200 component---src-layouts-templates-blog-tech-blog-js-668db3f9b71a3966ff38.js
www.perimeterx.com/ Frame B287 0
3 KB 125ms
125ms Other
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-blog-tech-blog-js-668db3f9b71a3966ff38.js

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAK61D7093NJ7F6M3DADJ
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2985
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:05 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "0413d3bf327423b73de857becf225857-ssl"
accept-ranges: bytes

GET
H2 200 component---src-layouts-templates-blog-tech-blog-authors-js-9ed68fb2884673daafca.js
www.perimeterx.com/ Frame B287 0
2 KB 127ms
125ms Other
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-blog-tech-blog-authors-js-9ed68fb2884673daafca.js

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAK64QT00MFZ4XP6N4N9T
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2112
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:05 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "2473458106d595cfeb7d48d0cb7ed498-ssl"
accept-ranges: bytes

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/index/ Frame B287 23 KB
4 KB 11ms
11ms XHR
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/index/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

6c161eaf631baf5bbdb7c35308da9ddac4d378263f6dd4423f3e3a2c86528fda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAK66QKV7NBT3CKSFTRP8
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: gzip
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 4037
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:04 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "96a5816c2bd86b34e3406cf142521d91-ssl"
accept-ranges: bytes

GET
H2 200 /
tr.lfeeder.com/ Frame B287 43 B
293 B 68ms
68ms Image
image/gif 143.204.89.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiMjEyODI4MDQ4Mi4xNjU4MjU0MDg0Il0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNTAuMSJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly93d3cucGVyaW1ldGVyeC5jb20vdGVjaC1ibG9nLzIwMjIvbWFsbHJhdHMtYW4tYW5hbHlzaXMtb2YtdGhlLW5hdHVyYWwtZnJlc2gtbWFsbC1tYWdlY2FydC1hdHRhY2svIiwicGFnZVRpdGxlIjoiTWFsbFJhdHM6IEFuIEFuYWx5c2lzIG9mIHRoZSBOYXR1cmFsIEZyZXNoIE1hbGwgTWFnZWNhcnQgQXR0YWNrIHwgUGVyaW1ldGVyWCIsInJlZmVycmVyIjoiaHR0cHM6Ly9yZXNvdXJjZXMucGVyaW1ldGVyeC5jb20vbmV3cy1uYXR1cmFsZnJlc2gtbWFnZWNhcnQtYW5hbHlzaXM/dXRtX3NvdXJjZT1tYXJrZXRvJnV0bV9tZWRpdW09ZW1haWwmdXRtX2NhbXBhaWduPW5ld3NsZXR0ZXItanVseS0yMDIyJm1rdF90b2s9TURBeExWWktXQzB4TURRQUFBR0Z0cGk5RHg3bWVvS1ZOeGlncTJ6cWg3ZVlLb0dSb3pXUnVYR0RSQ2J2d1ZDeUVJQ0dOQ1RmRS1VY0I4UXJxVWdISHpzTi1GNTRnTk53V2otdV8xbWRob3RNdl85VFFjbUJDNGRLUjBYQmlnMCJ9LCJldmVudCI6InRyYWNraW5nLWV2ZW50IiwiY2xpZW50RXZlbnRJZCI6IjE4NzQwZDhmZmI2ZDMwMGUiLCJzY3JpcHRJZCI6IjltRG5yZHlYMG5nMUtYTXYiLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiY29uc2VudExldmVsIjoibm9uZSIsImFub255bWl6ZUlwIjpmYWxzZSwibGZDbGllbnRJZCI6IkxGMS4xLmI1NzQ0Yzc1ZWJiOTEyZjkuMTY1ODI1NDA4NDc2NSIsImZvcmVpZ25Db29raWVzIjpbXSwicHJvcGVydGllcyI6e30sImF1dG9UcmFja2luZ0VuYWJsZWQiOnRydWUsImF1dG9UcmFja2luZ01vZGUiOiJvbl9zY3JpcHRfbG9hZCJ9
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-97.fra50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA50-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: Qv7Wz73bCB3r1MUw0P0leuPX8xU1KUF2NtIZyjd0mZHj0xhtck8tiA==

GET
H2 200 page-data.json Show response
www.perimeterx.com/page-data/about/careers/ Frame B287 14 KB
3 KB 13ms
10ms XHR
application/json 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/page-data/about/careers/page-data.json

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

61eef10fb6867c58353af2e0686c6eeb1456520f33a4fcc7dcf18755c848a15b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAK7R6ZBFT96HAHH1RNAB
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 0
vary: Accept-Encoding
content-length: 2755
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:08:05 GMT
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
etag: "ed3082f91f15dff29f043d6f338fe620-ssl"
accept-ranges: bytes

GET
H/1.1 200
OK dnb_coretag_v5.min.js Show response
cdn-0.d41.co/tags/ Frame B287 74 KB
75 KB 43ms
11ms Script
application/javascript 143.204.89.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.d41.co/tags/dnb_coretag_v5.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NQ65KGZ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-36.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6cc0b251ec54fdd5cd55d98cbe7a7af00bd34f9cfd71fd01ca08c83121c89720

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Tue, 19 Jul 2022 18:06:34 GMT
Via: 1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Last-Modified: Thu, 18 Nov 2021 14:57:39 GMT
Server: AmazonS3
Age: 95
ETag: "13bc1e6c74c25b3098a3b54b58b70b3c"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 76038
X-Amz-Cf-Id: vEiHPRgZlnsMG-BB6cS1Qu7_56Bl-tDCdDah7Ls51EHqG7pYfPSq-w==

GET
H3 200 collect
www.google-analytics.com/ Frame B287 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1635340195&t=pageview&_s=1&dl=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&dr=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&ul=en-us&de=UTF-8&dt=MallRats%3A%20An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%20%7C%20PerimeterX&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABQ~&jid=&gjid=&cid=2128280482.1658254084&tid=UA-57261032-1&_gid=2034036128.1658254084&gtm=2wg7i0NQ65KGZ&cd5=tech%20blog&cd6=2022&cd7=ben%20baryo&cd8=www.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&cd10=code%20defender&cd11=e-commerce&cd12=digital%20skimming%2Cpii%20harvesting&z=2057026741

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 04:27:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49220
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 component---src-layouts-templates-sectioned-page-index-js-626d166ad4fea1c10327.js
www.perimeterx.com/ Frame B287 0
231 KB 12ms
12ms Other
application/javascript 2a03:b0c0:3:d0::143f:d001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://www.perimeterx.com/component---src-layouts-templates-sectioned-page-index-js-626d166ad4fea1c10327.js

Requested by

Host: d33wubrfki0l68.cloudfront.net
URL: https://d33wubrfki0l68.cloudfront.net/bundles/5c0649612297aae80121dbf87e1deedd440464f8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:b0c0:3:d0::143f:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-nf-request-id: 01G8BTAK8RN8E0SBDQ81BK97FN
content-security-policy: frame-ancestors 'self' http://perimeterx.lookbookhq.com https://perimeterx.lookbookhq.com http://perimeterx.pathfactory.com https://perimeterx.pathfactory.com http://resources.perimeterx.com https://resources.perimeterx.com
content-encoding: br
x-content-type-options: nosniff
age: 121
vary: Accept-Encoding
content-length: 236218
x-xss-protection: 1; mode=block
server: Netlify
x-frame-options: DENY
date: Tue, 19 Jul 2022 18:06:04 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
etag: "1aa7352fcdbaae9126f9582f4499bd37-ssl"
accept-ranges: bytes

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/ Frame B287 12 KB
3 KB 22ms
20ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

868f2732413f5fcb021d726343ac249b6ca630db5fbd578f6525f279dda5c22b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: BkZngIV1hzEthgbkouRUbA==
age: 6036
vary: Accept-Encoding
content-length: 2832
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:04 GMT
server: cloudflare
etag: 0x8D8D8E825563082
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: fda93ca7-c01e-0026-14aa-2d4352000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56681eb80911f-FRA

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/ Frame B287 47 KB
11 KB 20ms
17ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.14.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.14.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5de3651c0aa89e6497da505565c8944039fd6480aa161b1f270d1f5953c9d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Jul 2022 18:08:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 8jNYupXcL2bcdab+1R7CAg==
age: 6036
vary: Accept-Encoding
content-length: 11511
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:07 GMT
server: cloudflare
etag: 0x8D8D8E827001198
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 466227d2-901e-007a-05aa-2db2ab000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 72d56681eb95911f-FRA

GET
H3 200 /
www.facebook.com/tr/ Frame B287 44 B
90 B 23ms
9ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=368880343933228&ev=PageView&dl=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&rl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&if=true&ts=1658254085427&sw=1600&sh=1200&v=2.9.65&r=stable&ec=0&o=30&fbp=fb.1.1658254084978.1235718807&it=1658254085224&coo=false&exp=u0&rqm=GET

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Tue, 19 Jul 2022 18:08:05 GMT

GET
H2 200 clickstream.js Show response
d10lpsik1i8c69.cloudfront.net/js/ Frame C927 287 KB
92 KB 18ms
18ms Script
application/javascript 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8

Request headers

Referer
Origin: https://www.perimeterx.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 27 May 2022 01:51:45 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 4637781
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
etag: W/"16e967413dfa0346be281513c77581b9"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 d55780b776b171387055eca956ae29a8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: ocUxG5NqvM1Ao6d1Slw1skvqqZ0iy1uVaFsA21kXDCv4G59BgWd_Pg==

GET
H2 200 /
tr.lfeeder.com/ Frame B287 43 B
293 B 54ms
50ms Image
image/gif 143.204.89.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiMjEyODI4MDQ4Mi4xNjU4MjU0MDg0Il0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNTAuMSJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly93d3cucGVyaW1ldGVyeC5jb20vdGVjaC1ibG9nLzIwMjIvbWFsbHJhdHMtYW4tYW5hbHlzaXMtb2YtdGhlLW5hdHVyYWwtZnJlc2gtbWFsbC1tYWdlY2FydC1hdHRhY2svIiwicGFnZVRpdGxlIjoiTWFsbFJhdHM6IEFuIEFuYWx5c2lzIG9mIHRoZSBOYXR1cmFsIEZyZXNoIE1hbGwgTWFnZWNhcnQgQXR0YWNrIHwgUGVyaW1ldGVyWCIsInJlZmVycmVyIjoiaHR0cHM6Ly9yZXNvdXJjZXMucGVyaW1ldGVyeC5jb20vbmV3cy1uYXR1cmFsZnJlc2gtbWFnZWNhcnQtYW5hbHlzaXM/dXRtX3NvdXJjZT1tYXJrZXRvJnV0bV9tZWRpdW09ZW1haWwmdXRtX2NhbXBhaWduPW5ld3NsZXR0ZXItanVseS0yMDIyJm1rdF90b2s9TURBeExWWktXQzB4TURRQUFBR0Z0cGk5RHg3bWVvS1ZOeGlncTJ6cWg3ZVlLb0dSb3pXUnVYR0RSQ2J2d1ZDeUVJQ0dOQ1RmRS1VY0I4UXJxVWdISHpzTi1GNTRnTk53V2otdV8xbWRob3RNdl85VFFjbUJDNGRLUjBYQmlnMCJ9LCJldmVudCI6InRyYWNraW5nLWV2ZW50IiwiY2xpZW50RXZlbnRJZCI6IjEyMTlhYTUxZTYxYmFmNWYiLCJzY3JpcHRJZCI6IjltRG5yZHlYMG5nMUtYTXYiLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiY29uc2VudExldmVsIjoibm9uZSIsImFub255bWl6ZUlwIjpmYWxzZSwibGZDbGllbnRJZCI6IkxGMS4xLmI1NzQ0Yzc1ZWJiOTEyZjkuMTY1ODI1NDA4NDc2NSIsImZvcmVpZ25Db29raWVzIjpbXSwicHJvcGVydGllcyI6e30sImF1dG9UcmFja2luZ0VuYWJsZWQiOnRydWUsImF1dG9UcmFja2luZ01vZGUiOiJvbl9zY3JpcHRfbG9hZCJ9
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-97.fra50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA50-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: Stw-nwYkTWOyJYS6irMHobRp5RZereVK3Ye6p14jfE74IVuH7l9m7A==

GET
H/1.1 200
OK api Show response
api9130.d41.co/ Frame B287 1 KB
2 KB 110ms
109ms Fetch
application/json 54.81.167.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api9130.d41.co/api?req=api9130&form=json

Requested by

Host: cdn-0.d41.co
URL: https://cdn-0.d41.co/tags/dnb_coretag_v5.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.81.167.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-81-167-22.compute-1.amazonaws.com

Software

Resource Hash

f477c7dda86009c36f1b4a8b4e3619462ec80b5aa5095b6ba941138dd6a87428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:05 GMT
Referrer-Policy: no-referrer-when-downgrade
Expect-CT: max-age=30, report-uri="https://a54b4ab95d40a8b116fae47033b75682.report-uri.com/r/d/ct/reportOnly"
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: application/json
access-control-allow-origin: https://www.perimeterx.com
Cache-control: no-store
access-control-allow-credentials: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 1326
X-XSS-Protection: 1; mode=block

GET
DATA 200
OK truncated
/ Frame B287 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=368880343933228&ev=Microdata&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&rl=https%3A%2F%2Fmkto-sj130112.com%2F&if=false&ts=1658254085550&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%22%2C%22meta%3Adescription%22%3A%22A%20breakdown%20of%20the%20attack%20techniques%20used%20in%20the%20campaign%20and%20its%20predecessors.%22%7D&cd[OpenGraph]=%7B%22og%3Atitle%22%3A%22An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%22%2C%22og%3Adescription%22%3A%22A%20breakdown%20of%20the%20attack%20techniques%20used%20in%20the%20campaign%20and%20its%20predecessors.%22%2C%22og%3Asite_name%22%3A%22PerimeterX%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fcdn.pathfactory.com%2Fassets%2F10557%2Fcontents%2F419524%2Fthumbnails%2F600x%2Fblog-2557x1441-magecart-mallrats_ntdyhn.png%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.65&r=stable&ec=1&o=30&fbp=fb.1.1658254084978.1235718807&it=1658254084632&coo=false&es=automatic&tm=3&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Tue, 19 Jul 2022 18:08:05 GMT

GET
H2 200 /
tr.lfeeder.com/ Frame B287 43 B
294 B 34ms
33ms Image
image/gif 143.204.89.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=9mDnrdyX0ng1KXMv&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTU3MjYxMDMyLTEiXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVM1Q1daRjUxSDIiXSwiZ2FDbGllbnRJZHMiOlsiMjEyODI4MDQ4Mi4xNjU4MjU0MDg0Il0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjIuNTAuMSJ9LCJwYWdlVXJsIjoiaHR0cHM6Ly93d3cucGVyaW1ldGVyeC5jb20vdGVjaC1ibG9nLzIwMjIvbWFsbHJhdHMtYW4tYW5hbHlzaXMtb2YtdGhlLW5hdHVyYWwtZnJlc2gtbWFsbC1tYWdlY2FydC1hdHRhY2svIiwicGFnZVRpdGxlIjoiTWFsbFJhdHM6IEFuIEFuYWx5c2lzIG9mIHRoZSBOYXR1cmFsIEZyZXNoIE1hbGwgTWFnZWNhcnQgQXR0YWNrIHwgUGVyaW1ldGVyWCIsInJlZmVycmVyIjoiaHR0cHM6Ly9yZXNvdXJjZXMucGVyaW1ldGVyeC5jb20vbmV3cy1uYXR1cmFsZnJlc2gtbWFnZWNhcnQtYW5hbHlzaXM/dXRtX3NvdXJjZT1tYXJrZXRvJnV0bV9tZWRpdW09ZW1haWwmdXRtX2NhbXBhaWduPW5ld3NsZXR0ZXItanVseS0yMDIyJm1rdF90b2s9TURBeExWWktXQzB4TURRQUFBR0Z0cGk5RHg3bWVvS1ZOeGlncTJ6cWg3ZVlLb0dSb3pXUnVYR0RSQ2J2d1ZDeUVJQ0dOQ1RmRS1VY0I4UXJxVWdISHpzTi1GNTRnTk53V2otdV8xbWRob3RNdl85VFFjbUJDNGRLUjBYQmlnMCJ9LCJldmVudCI6InRyYWNraW5nLWV2ZW50IiwiY2xpZW50RXZlbnRJZCI6Ijk1NThlYTYxZjM3YTc5ZDUiLCJzY3JpcHRJZCI6IjltRG5yZHlYMG5nMUtYTXYiLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiY29uc2VudExldmVsIjoibm9uZSIsImFub255bWl6ZUlwIjpmYWxzZSwibGZDbGllbnRJZCI6IkxGMS4xLmI1NzQ0Yzc1ZWJiOTEyZjkuMTY1ODI1NDA4NDc2NSIsImZvcmVpZ25Db29raWVzIjpbXSwicHJvcGVydGllcyI6e30sImF1dG9UcmFja2luZ0VuYWJsZWQiOnRydWUsImF1dG9UcmFja2luZ01vZGUiOiJvbl9zY3JpcHRfbG9hZCJ9
Requested by: Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-97.fra50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA50-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: xExwC5J7Hj8rWybsJ769JyITU3q4Jzgu9XaxqFpuW-trHLgrF9Y7sQ==

GET
H3 200 collect
www.google-analytics.com/ Frame B287 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1635340195&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&dr=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&ul=en-us&de=UTF-8&dt=MallRats%3A%20An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%20%7C%20PerimeterX&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=undefined&ea=undefined&_u=SDCAAEABQ~&jid=&gjid=&cid=2128280482.1658254084&tid=UA-57261032-1&_gid=2034036128.1658254084&gtm=2wg7i0NQ65KGZ&cd2=507026974%7CCore-Backbone%20GmbH&cd5=tech%20blog&cd6=2022&cd8=www.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&cd10=code%20defender&cd11=e-commerce&cd12=digital%20skimming%2Cpii%20harvesting&cd17=2M-5M&cd18=54151&z=1940907814

Requested by

Host: www.perimeterx.com
URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 04:27:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49220
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 453 B
471 B 58ms
58ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 72ec054f7c7d59fbcfb05fb876a1331171c993a1ecd83d325f434ce9d20cee6b

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:08:04 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 453

GET
H2 200 logo-light.png
d10lpsik1i8c69.cloudfront.net/graphics/ Frame B287 1 KB
1 KB 9ms
8ms Image
image/png 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/logo-light.png
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c34bc7bc1985e63394c3c2afff88cdcfc06e501320432dd23eaff83ea6754eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 08:42:23 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 465942
etag: "35ce74c31e3ef54462a234340af702d7"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 1143
x-amz-cf-id: qo8-yXvmGwy8UK8qGGKNX7SiSedNDsP44D0kU0mqRNOkyFBSelBOyA==

GET
H2 200 sound-on-white.png
d10lpsik1i8c69.cloudfront.net/graphics/ Frame B287 277 B
620 B 10ms
9ms Image
image/png 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/sound-on-white.png
Requested by: Host: resources.perimeterx.com
URL: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: da0c1bc51d4ebfa2570f3e7546d9d3ccfb3f9d3c1199b1ca49869510aa79392a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 14 Jun 2022 01:16:29 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 3084696
etag: "76f1993de0fd323f67cece8d8e63bfa2"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 277
x-amz-cf-id: QjvOYEABxN-PDMLoeOLC1_11A5x_-1HVRysssGJrNRrYzrdZFynaLg==

GET
H2 200 logo-light.png
d10lpsik1i8c69.cloudfront.net/graphics/ 1 KB
1 KB 9ms
8ms Image
image/png 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/logo-light.png
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c34bc7bc1985e63394c3c2afff88cdcfc06e501320432dd23eaff83ea6754eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 08:42:23 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 465942
etag: "35ce74c31e3ef54462a234340af702d7"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 1143
x-amz-cf-id: RU2NHa0aYjn3Z-fF0PnA6LYLsg2huLyypJils8ujoTmZj2CVyVcF4A==

GET
H2 200 sound-on-white.png
d10lpsik1i8c69.cloudfront.net/graphics/ 277 B
620 B 10ms
9ms Image
image/png 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d10lpsik1i8c69.cloudfront.net/graphics/sound-on-white.png
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: da0c1bc51d4ebfa2570f3e7546d9d3ccfb3f9d3c1199b1ca49869510aa79392a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 14 Jun 2022 01:16:29 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 3084696
etag: "76f1993de0fd323f67cece8d8e63bfa2"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 277
x-amz-cf-id: ELawPjLrdX_0zjsmU23xH7_0MOhcdgG4L9fYYtyU9OPyf5evOiF81A==

GET
H2

200

/
attr.ml-api.io/ Frame B287
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

0
242 B

166ms
166ms

Image
application/json

2600:9000:2156:8e00:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Protocol: H2
Server: 2600:9000:2156:8e00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
apigw-requestid: Vhro_jHnoAMES0g=
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: B8her8eQ2xuVc_jQXcFeI5sZVFEwpDBYF4bgfNlLduGYUUTPdfBswQ==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:06 GMT
X-Proxy-Origin: 81.95.5.43; 81.95.5.43; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e15e7573-cd04-4417-bcc2-1e52dc09edd4
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dperimeterx.com%26pId%3d%24UID
https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834

0
242 B

488ms
488ms

Image
application/json

2600:9000:2156:8e00:12:3734:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Protocol: H2
Server: 2600:9000:2156:8e00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
apigw-requestid: VhrpBjpBIAMES-g=
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: application/json
content-length: 0
x-amz-cf-id: Ge-W0lQ6k9Mmm_uE327Ruc6OyFICAjFbaCOgQlSgV0D_Iq5KvW8sdQ==

Redirect headers

Pragma: no-cache
Date: Tue, 19 Jul 2022 18:08:06 GMT
X-Proxy-Origin: 81.95.5.43; 81.95.5.43; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: c906c23e-e25d-4110-9b7b-e042090fa01d
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=perimeterx.com&pId=8997546345520094834
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 a
www.googletagmanager.com/ 0
17 B 22ms
21ms Image
image/gif 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=GTM-PCDTQ25&cv=123&t=ol&p=gtmo&l=621&q=207&f=62&e=414&i=9&d=615&c=-443&hc=0&sr=0.050000&ps=0.049584361753741035&cb=1955119296

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:08:05 GMT
server: Google Tag Manager
vary: *
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
12ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1182229276&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=25&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=2128280482.1658254084&tid=UA-57261032-1&_gid=2034036128.1658254084&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&cd10=null&cd11=null&cd12=null&z=1132224718

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 04:27:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49221
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 28ms
19ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1182229276&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=50&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=2128280482.1658254084&tid=UA-57261032-1&_gid=2034036128.1658254084&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&cd10=null&cd11=null&cd12=null&z=349351775

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 04:27:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49221
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 28ms
19ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1182229276&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=75&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=2128280482.1658254084&tid=UA-57261032-1&_gid=2034036128.1658254084&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&cd10=null&cd11=null&cd12=null&z=937811953

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 04:27:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49221
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 28ms
19ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1182229276&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dr=https%3A%2F%2Fmkto-sj130112.com%2F&ul=en-us&de=UTF-8&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fnews-naturalfresh-magecart-analysis&el=100&_u=aDDAAEABQAAAAC~&jid=&gjid=&cid=2128280482.1658254084&tid=UA-57261032-1&_gid=2034036128.1658254084&gtm=2wg7i0NQ65KGZ&cd5=news%20naturalfresh%20magecart%20analysis&cd8=resources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&cd10=null&cd11=null&cd12=null&z=1131141019

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 04:27:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49221
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 5D7B 0
15 B 28ms
20ms Document
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.perimeterx.com
Referer: https://www.perimeterx.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.perimeterx.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Tue, 19 Jul 2022 18:08:06 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 reset.css
d10lpsik1i8c69.cloudfront.net/css/ Frame B287 2 KB
1 KB 8ms
8ms Stylesheet
text/css 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/css/reset.css
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 401f533697cfb484598d2da76b5f4708bbca985a1fab42dbcfaa0741374d3245

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 13 Jul 2022 04:43:22 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 566685
etag: W/"7144eaceff0b31347712515a6116074e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: z_qATqcfqOk-2K8bTJW6R8Dqw9Rl45wVMbM6ENb_g89zepU_zQ33Sw==

POST
H3 200 recordings:publish Show response
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame C927 49 B
87 B 38ms
21ms XHR
application/json 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recordings:publish

Requested by

Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

303908648aeba5ba1158683235f83afbbaa98a391a4dc5b4c5ed4d819ba0c255

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer
Authorization: Bearer ya29.c.b0AXv0zTMOckEhHwiaku_2ISMBXo8Zl6BHjm1VB19RyLDJDc_fYMulsgGcCWVrnSl7qtu1uGQ1Y_UkbkB3e7EUmOkgqkLkAOBBJjKIM2dOVuqaMCKCbfTMpmcBc4UGaebjUAQ9wO8HwQYpoQ-wAuj8J9V8SqwwJf6vQIJ6Ozm0B4umIhtqm9g-ajtoba2JFeZDKCcuI9zRPWzjZ4uRRNFsGQGJHeEfv06LolY....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.perimeterx.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 64
x-xss-protection: 0

OPTIONS
H2 200 recordings:publish
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame 0
0 38ms
8ms Preflight
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recordings:publish

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.perimeterx.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Tue, 19 Jul 2022 18:08:06 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 recordings:publish Show response
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame C927 49 B
87 B 36ms
22ms XHR
application/json 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recordings:publish

Requested by

Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d2e875a4cd800cf50dc0c0e37f3ce4e945ff600d25ad5274fb7889bb9d4be0d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer
Authorization: Bearer ya29.c.b0AXv0zTMOckEhHwiaku_2ISMBXo8Zl6BHjm1VB19RyLDJDc_fYMulsgGcCWVrnSl7qtu1uGQ1Y_UkbkB3e7EUmOkgqkLkAOBBJjKIM2dOVuqaMCKCbfTMpmcBc4UGaebjUAQ9wO8HwQYpoQ-wAuj8J9V8SqwwJf6vQIJ6Ozm0B4umIhtqm9g-ajtoba2JFeZDKCcuI9zRPWzjZ4uRRNFsGQGJHeEfv06LolY....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.perimeterx.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 64
x-xss-protection: 0

OPTIONS
H2 200 recordings:publish
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame 0
0 7ms
7ms Preflight
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recordings:publish

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.perimeterx.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Tue, 19 Jul 2022 18:08:06 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 reset.css
d10lpsik1i8c69.cloudfront.net/css/ 2 KB
1 KB 8ms
8ms Stylesheet
text/css 143.204.101.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/css/reset.css
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-166.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 401f533697cfb484598d2da76b5f4708bbca985a1fab42dbcfaa0741374d3245

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 13 Jul 2022 04:43:22 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
age: 566685
etag: W/"7144eaceff0b31347712515a6116074e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: KkoOIsJ3QEhpNjTxgXRVTdUbyUI4bct8AJjHl8fQqSaZkHZ4bD9w5A==

POST
H3 200 recordings:publish Show response
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame 5620 49 B
87 B 17ms
17ms XHR
application/json 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recordings:publish

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b970be607d574f5ff825f40713871769073e788d7e2b117d4ff4e39820f850f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer
Authorization: Bearer ya29.c.b0AXv0zTMOckEhHwiaku_2ISMBXo8Zl6BHjm1VB19RyLDJDc_fYMulsgGcCWVrnSl7qtu1uGQ1Y_UkbkB3e7EUmOkgqkLkAOBBJjKIM2dOVuqaMCKCbfTMpmcBc4UGaebjUAQ9wO8HwQYpoQ-wAuj8J9V8SqwwJf6vQIJ6Ozm0B4umIhtqm9g-ajtoba2JFeZDKCcuI9zRPWzjZ4uRRNFsGQGJHeEfv06LolY....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 64
x-xss-protection: 0

OPTIONS
H3 200 recordings:publish
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame 0
0 17ms
9ms Preflight
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recordings:publish

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://resources.perimeterx.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Tue, 19 Jul 2022 18:08:06 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
BLOB 200
OK 9b8fed97-a407-4b34-bb8d-4315b7d4947d
https://www.perimeterx.com/ Frame C927 0
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.perimeterx.com/9b8fed97-a407-4b34-bb8d-4315b7d4947d
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 0

GET
BLOB 200
OK 4c5ea3f2-b5a5-4a30-b825-59f83abf2efe
https://www.perimeterx.com/ Frame C927 30 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.perimeterx.com/4c5ea3f2-b5a5-4a30-b825-59f83abf2efe
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb5a1fff57218742c5c1e469970504556a10d235b2379872b4ffcef9901d3bc0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 31224

GET
BLOB 200
OK 747d48fe-2c6a-46f6-834b-53f874b851a1
https://resources.perimeterx.com/ Frame 5620 0
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://resources.perimeterx.com/747d48fe-2c6a-46f6-834b-53f874b851a1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 0

GET
BLOB 200
OK fe3cadf8-64da-488e-87fe-ce0e84f31457
https://resources.perimeterx.com/ Frame 5620 30 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://resources.perimeterx.com/fe3cadf8-64da-488e-87fe-ce0e84f31457
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb5a1fff57218742c5c1e469970504556a10d235b2379872b4ffcef9901d3bc0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Length: 31224

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 57ms
56ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 1cc8aac593605d506c2f6443c77439ab1bd56c02f53cfcae401a6659ae90a6d3

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:08:05 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 200 recording-data:publish Show response
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame C927 49 B
87 B 34ms
20ms XHR
application/json 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recording-data:publish

Requested by

Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

973f99c63f827fdc720bfd039b2b654e2fdd78e33a7b690b54f4450224816ec3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer
Authorization: Bearer ya29.c.b0AXv0zTMOckEhHwiaku_2ISMBXo8Zl6BHjm1VB19RyLDJDc_fYMulsgGcCWVrnSl7qtu1uGQ1Y_UkbkB3e7EUmOkgqkLkAOBBJjKIM2dOVuqaMCKCbfTMpmcBc4UGaebjUAQ9wO8HwQYpoQ-wAuj8J9V8SqwwJf6vQIJ6Ozm0B4umIhtqm9g-ajtoba2JFeZDKCcuI9zRPWzjZ4uRRNFsGQGJHeEfv06LolY....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.perimeterx.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 64
x-xss-protection: 0

OPTIONS
H3 200 recording-data:publish
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame 0
0 8ms
7ms Preflight
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recording-data:publish

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.perimeterx.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Tue, 19 Jul 2022 18:08:06 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

OPTIONS
H3 200 recording-data:publish
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame 0
0 10ms
9ms Preflight
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recording-data:publish

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://resources.perimeterx.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-headers: authorization,content-type
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://resources.perimeterx.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Tue, 19 Jul 2022 18:08:06 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 recording-data:publish Show response
pubsub.googleapis.com/v1/projects/lucky-orange/topics/ Frame 5620 49 B
87 B 38ms
26ms XHR
application/json 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubsub.googleapis.com/v1/projects/lucky-orange/topics/recording-data:publish

Requested by

Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

551db934eceff097ce2ce5a79bd4defe542b37382692740f3ee34631cab54568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer
Authorization: Bearer ya29.c.b0AXv0zTMOckEhHwiaku_2ISMBXo8Zl6BHjm1VB19RyLDJDc_fYMulsgGcCWVrnSl7qtu1uGQ1Y_UkbkB3e7EUmOkgqkLkAOBBJjKIM2dOVuqaMCKCbfTMpmcBc4UGaebjUAQ9wO8HwQYpoQ-wAuj8J9V8SqwwJf6vQIJ6Ozm0B4umIhtqm9g-ajtoba2JFeZDKCcuI9zRPWzjZ4uRRNFsGQGJHeEfv06LolY....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 64
x-xss-protection: 0

POST
H3 200 p Show response
b.px-cdn.net/api/v1/PX2003/d/ 3 B
19 B 41ms
24ms XHR
application/json 34.120.92.56
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://b.px-cdn.net/api/v1/PX2003/d/p
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.120.92.56 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 56.92.120.34.bc.googleusercontent.com
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: multipart/form-data; boundary=----------------uazwjiu1sxbcmzwp

Response headers

date: Tue, 19 Jul 2022 18:08:06 GMT
via: 1.1 google
access-control-allow-headers: authorization
access-control-allow-methods: HEAD,GET,POST,OPTIONS
content-type: application/json
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 76ms
76ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 5141b19e22fd4eb74b589aeeb44bad1d4acb56b018dd1794cc8d93d9f3487307

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:08:07 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 55ms
54ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 2d8f4aebbb445c1037c1c719df07feaeb1f6ed06b277c039d31f17b42a9bac3f

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:08:07 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 200 collector Show response
sapi2003.botchk.net/api/v2/ 441 B
459 B 48ms
48ms XHR
application/json 35.186.220.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sapi2003.botchk.net/api/v2/collector
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.220.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 184.220.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 16ad751a636637aa8f41bcefc85b257f201b3b87324994f6f418bb5835d3dd9c

Request headers

Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Jul 2022 18:08:08 GMT
via: 1.1 google
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: https://resources.perimeterx.com
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 32ms
15ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-S5CWZF51H2&gtm=2oe7i0&_p=1182229276&_z=ccd.v9B&cid=2128280482.1658254084&ul=en-us&sr=1600x1200&_s=2&sid=1658254084&sct=1&seg=0&dl=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dr=https%3A%2F%2Fmkto-sj130112.com%2F&dt=An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack&en=scroll&epn.percent_scrolled=90&_et=110
Requested by: Host: client.px-cloud.net
URL: https://client.px-cloud.net/PX2003/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://resources.perimeterx.com/news-naturalfresh-magecart-analysis?utm_source=marketo&utm_medium=email&utm_campaign=newsletter-july-2022&mkt_tok=MDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:08:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://resources.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ Frame B287 0
17 B 15ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-S5CWZF51H2&gtm=2oe7i0&_p=1635340195&_z=ccd.v9B&cid=2128280482.1658254084&ul=en-us&sr=1600x1200&_s=1&sid=1658254084&sct=1&seg=1&dl=https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F&dr=https%3A%2F%2Fresources.perimeterx.com%2Fnews-naturalfresh-magecart-analysis%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dnewsletter-july-2022%26mkt_tok%3DMDAxLVZKWC0xMDQAAAGFtpi9Dx7meoKVNxigq2zqh7eYKoGRozWRuXGDRCbvwVCyEICGNCTfE-UcB8QrqUgHHzsN-F54gNNwWj-u_1mdhotMv_9TQcmBC4dKR0XBig0&dt=MallRats%3A%20An%20Analysis%20of%20the%20Natural%20Fresh%20Mall%20Magecart%20Attack%20%7C%20PerimeterX&en=page_view
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S5CWZF51H2&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.perimeterx.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jul 2022 18:08:10 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.perimeterx.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

54 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mkto-sj130112.com/	1970-01-20 04:37:35	Name: __cf_bm Value: qqXVHO0GbbPFMv50QmF_ibMeG8z8L0VkSNYJ8IvLIrU-1658254082-0-AdDQ2F/X4AjezLf1JkoU744E0malNW2SdyFWnrVdW5Yj/YPkqXqwlXfdBS2TJ4ZVTWZdPKkjjfvLnSGeEAGGPdc=
.perimeterx.com/	1970-01-20 22:08:46	Name: vid Value: 3e38051b-1b6a-4d89-b90b-3f7f498927f2
resources.perimeterx.com/	1970-01-20 22:10:12	Name: _session_id Value: Q1p6UmlzY0pDc0J6ODRTR1FmOGkrRHFFYTY2Y2k3QUVQTHRIT3J2endBVDlZcFB0dHdIWXZNRERwcjY0cHFEenZvakJjYVl2Z2VDc1FLWGpMRzgvbFkvOFdheG53dEt0YTJuSUh6Z3JmVEtiRW53WFMvVjdyT2hSNDVsUVY2UklpUXhueHhNenBGRFp4WStlV09pck56aTZiUGw5MG9OOEo5Slh2dnBZR2d4MXVSMlNMYTZVWGRFaWZ1ZDY2aGtxc3drcmZpWHg2V3RmNDVFU1dHMWI5Y01mUGNnSUVWQTlYZWE1SVVhN3Y4Zy9RelREQ0NUdjNiSzhlZWg0UjVtdnNqbi9PRjdqZldOR1FGamt4Rm1TTG1MOHNKMUtZbjd5SXBSMVdoQXFrR1U9LS01RjZlMmhtb1psT0R5WXF0S3llR3hBPT0%3D--e5e3821fdb5160dbfe920a534b97658782a76620
.perimeterx.com/	1970-01-20 13:23:10	Name: _px_uAB Value: MTMzN3xmYWxzZQ==
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: 28DGzqWeVqI
.youtube.com/	1970-01-20 08:56:46	Name: VISITOR_INFO1_LIVE Value: JguE6Z6DYyI
tracking.g2crowd.com/	1970-01-20 04:57:43	Name: _session_id Value: fa4643f85e402ac3f0728572dff09288
.g2crowd.com/	1970-01-20 04:37:35	Name: __cf_bm Value: u_PEx0UOeV2m4G22GeO80XKLTbGiDTogJIA38ZPh6.M-1658254083-0-AQMPOtaKoXc9tHQ2wRGM0YUiHWZCOS1E4qXvGXh7pbOnN3SKAyGJM5DHB2OL2CxnVeqLj7rLH0h2Wy7G8WWQki0=
resources.perimeterx.com/	1969-12-31 23:59:59	Name: pxcts Value: bbae9116-078d-11ed-bda8-677150496752
resources.perimeterx.com/	1970-01-20 13:23:10	Name: _pxvid Value: bbae8217-078d-11ed-bda8-677150496752
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_bdd Value: 1000
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_idp_c Value: 1,s
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_idp_p Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_cl Value: 888
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_scs Value: 1,WOWMAN
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_wow Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_ww Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_wp Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_sp Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_cd Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_rf Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_af_se Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_gqlr Value: 1
resources.perimeterx.com/	1970-01-20 04:37:34	Name: _pxff_rid Value: 9715777812338345693
.perimeterx.com/	1970-01-20 13:24:36	Name: __pxvid Value: bbce6be9-078d-11ed-a5d8-0242ac120003
.adnxs.com/	1970-01-20 06:47:10	Name: uuid2 Value: 8997546345520094834
.perimeterx.com/	1970-01-20 22:08:46	Name: _mkto_trk Value: id:001-VJX-104&token:_mch-perimeterx.com-1658254084280-53925
.perimeterx.com/	1970-01-20 04:39:00	Name: _gid Value: GA1.2.2034036128.1658254084
.perimeterx.com/	1970-01-20 04:37:34	Name: _gat_UA-57261032-1 Value: 1
.app-sj13.marketo.com/	1970-01-20 04:37:35	Name: __cf_bm Value: IL47SE8T3C9bxguE9xY.NBFTZsYeNHJ9ZM3GscC.iH0-1658254084-0-AUD1mXkknYp6TnQyEe9EYQQpnwTZJf1XmYxCeFD3yXYKrNgn2FCsk+UCqq0rAfys0bWAIbi3ZwgSplSWVuxhg34=
.linkedin.com/	1970-01-20 05:20:46	Name: UserMatchHistory Value: AQJqSpDGi7AgawAAAYIXpUi802mGs2cwiLTNbMQHRKc5XpU1u5eNkJjhCdZeTOHNtoBKg18n6Pjtzg
.linkedin.com/	1970-01-20 05:20:46	Name: AnalyticsSyncHistory Value: AQK-1JrwaUaisAAAAYIXpUi8hfdynsaGpb2pdUigqfpBH3kV9Q6J6Y0FUmgEK9Ln2EQuycNvTO92I7lDcokFMA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 22:09:27	Name: bcookie Value: "v=2&523537e2-020e-401a-8215-5b4d373751f1"
.linkedin.com/	1970-01-20 04:39:00	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=2762:u=1:x=1:i=1658254084:t=1658340484:v=2:sig=AQE5sYQT0UiIJ6GzLCOO7MchVQ5dLANp"
.bidr.io/	1970-01-20 14:06:07	Name: bito Value: AAAZ5k7FreYAAEbthcQCaQ
.bidr.io/	1970-01-20 14:06:07	Name: bitoIsSecure Value: ok
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 22:09:27	Name: bscookie Value: "v=1&202207191808045bb244a8-f04b-4a65-8727-b6ff3aa46cfcAQF9SwmBddy2YmvXWkVq_fpHj36wBo3Y"
.linkedin.com/	1970-01-20 22:04:18	Name: li_gc Value: MTswOzE2NTgyNTQwODQ7MjswMjHApVy7SYlSnF2D8pnrcH079e3JGrx17HCax5GKZItkdg==
.perimeterx.com/	1970-01-20 22:08:46	Name: _lfa Value: LF1.1.b5744c75ebb912f9.1658254084765
.perimeterx.com/	1970-01-20 06:47:10	Name: _fbp Value: fb.1.1658254084978.1235718807
jukebox.pathfactory.com/	1970-01-20 22:10:12	Name: _session_id Value: a2ZUME9Bbi9kc0pUY2FqU3gyejR0RStnRTM1Y0dPbWhVT1drSFdsdk9WTzFpNWJyTzVuOWhuVzdXL01SN25ucm1Kb2lTVGdNd0pMdjlqVTk2ZnZNU2ZoRnkreS9SVkxNRWZvYkZydmdGVnRpaU9DREpiNklVUTV0ZTlpUnFZaklKYnAwQ29NdTNMTGdnN3lpaGdXY05kbVcxaHhDUC9RSTM5TU93bW1zdEs5emtTTmpQaGhQQkpySzk2Skp6bzVOLS02U0JSZUNNTEsrYTlXTUM3OTdZUGh3PT0%3D--30bbc5467ff563cff4408abf70b29cf914e21589
.ws.zoominfo.com/	1970-01-20 13:23:10	Name: visitorId Value: d87bdf031dda974e5fb8b76442669b726c61515b6816c9d6f75b73768c6ba530
.perimeterx.com/	1970-01-20 22:08:46	Name: _ga_S5CWZF51H2 Value: GS1.1.1658254084.1.1.1658254085.0
.perimeterx.com/	1970-01-20 22:08:46	Name: _ga Value: GA1.2.2128280482.1658254084
.perimeterx.com/	1970-01-20 08:56:46	Name: __lotr Value: https%3A%2F%2Fmkto-sj130112.com%2F
.perimeterx.com/	1970-01-20 13:23:10	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Tue+Jul+19+2022+18%3A08%3A05+GMT%2B0000+(GMT)&version=6.14.0&hosts=&consentId=9871065c-2f2d-4483-aca7-942a54b061b7&interactionCount=0&landingPath=NotLandingPage&groups=C0004%3A1%2CC0003%3A1%2CBG16%3A1%2CC0001%3A1%2CC0002%3A1&AwaitingReconsent=false
.perimeterx.com/	1970-01-20 22:08:46	Name: _lo_uid Value: 84276-1658254085309-a048313339335c02
.perimeterx.com/	1970-01-20 04:37:34	Name: _lorid Value: 84276-1658254085309-0763b93c16b4a251
.perimeterx.com/	1970-01-20 13:23:10	Name: _lo_v Value: 1
.perimeterx.com/	1970-01-20 08:56:46	Name: __lotl Value: https%3A%2F%2Fwww.perimeterx.com%2Ftech-blog%2F2022%2Fmallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack%2F
.perimeterx.com/	1970-01-20 22:08:46	Name: _px_f394gi7Fvmc43dfg_user_id Value: YmNkOGEwNTAtMDc4ZC0xMWVkLTlkNDQtOTE2MDg2YzFjNGJh
resources.perimeterx.com/	1970-01-20 04:40:26	Name: _px Value: x7nbIJUnJA0pDO/nIJROwOXavF4+CSd5AJJMwydYzYGblMN+O3DSL7VIP65tXSOplCsKFw/8aPH9GJiOA70JUA==:1000:nDgNlBWVnupHDa50dGfeONiW4moQu2JR0/Yf1ns47LWHJX9sgKNSXxb4CDb4XSnvfeTIcnAy/s18VoTBrYnDB2HjHE4XDi4fPPpSr98N+2hQgtHu/8Y1cvwmBemqUw2f31EnVgpH5ON7befalyFBxDxV8zWWERTRaF7vLoi39a+fo6OJtRheDSArflep4rUqiDs3X8IxBIWzNdQl/WgzSmKk8hnQPIttmnjtqF7+zRZCylUy8AQIoGE1HbgBk8Ri0rFjR9G6yBF99IgBfmWB/w==

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A= Message: The Content-Security-Policy directive name 'form-action:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security	error	URL: https://mkto-sj130112.com/MDAxLVZKWC0xMDQAAAGFtpi9D5GcSbdasEQL3ICv6apFIpjoa77lijASKetsnH2sSFNSdqShpZSMQPs7g9ZePKnGo6A= Message: The Content-Security-Policy directive name 'frame-src:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/c9c6fe98-9161238368d370bda929.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/6d317829-d3d402e5b3de0a374184.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/1bfc9850-e346f70a0d188b802bed.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/app-ee317304c744ef04cb69.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/styles-83801f3b4dd3459a4027.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/5d29be3a39afb3d02c470836880ef3668828850c-96f6cdc519f233150bf2.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/9815f04a81c9d7b5d54b3cfd1cb9f97e68eecb8a-4c69d8ab0a860387cfd2.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/5e2a4920-20a4bced7ddf9a73ac28.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/webpack-runtime-514465b51ac6845ee75f.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/framework-3bb7604d37b8059061f5.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/95b64a6e-61f21e012229bde8e9f0.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.perimeterx.com/tech-blog/2022/mallrats-an-analysis-of-the-natural-fresh-mall-magecart-attack/ Message: The resource https://www.perimeterx.com/component---src-layouts-templates-blog-blog-post-js-4cb3b9f77e1259b40c6d.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-bM8752GdLsMZ0sWpB998JRzg1sYQncSTekj5MQ+bDY8=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

001-vjx-104.mktoresp.com
api9130.d41.co
app-sj13.marketo.com
app.cdn.lookbookhq.com
assets.perimeterx.com
attr.ml-api.io
b.px-cdn.net
cdn-0.d41.co
cdn-app.pathfactory.com
cdn.cookielaw.org
cdn.pathfactory.com
client.px-cloud.net
cnv.event.prod.bidr.io
connect.facebook.net
d.adroll.com
d10lpsik1i8c69.cloudfront.net
d33wubrfki0l68.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
maxcdn.bootstrapcdn.com
mkto-sj130112.com
munchkin.marketo.net
overpass-30e2.kxcdn.com
pubsub.googleapis.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
resources.perimeterx.com
s.adroll.com
s.ml-attr.com
sapi2003.botchk.net
secure.adnxs.com
settings.luckyorange.net
snap.licdn.com
stats.g.doubleclick.net
tr.lfeeder.com
tracking.g2crowd.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.perimeterx.com
www.youtube.com
100.24.141.224
104.16.94.80
104.17.71.206
13.107.42.14
13.32.99.99
143.204.101.166
143.204.89.23
143.204.89.36
143.204.89.97
172.67.75.100
18.64.103.56
18.66.242.175
18.66.248.127
192.28.147.68
2001:4860:4802:32::36
23.205.237.4
2600:9000:2156:8e00:12:3734:2a40:93a1
2600:9000:2156:9000:6:9280:1080:93a1
2606:4700:4400::ac40:97c9
2606:4700::6810:9440
2606:4700::6810:a852
2606:4700::6812:bcf
2620:1ec:21::14
2a00:1450:4001:806::200e
2a00:1450:4001:808::2003
2a00:1450:4001:808::200a
2a00:1450:4001:810::2003
2a00:1450:4001:812::2004
2a00:1450:4001:813::200a
2a00:1450:4001:828::2008
2a00:1450:400c:c0c::9b
2a02:26f0:3500:16::215:149b
2a02:26f0:ef::5c7b:c2a4
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a03:b0c0:3:d0::143f:d001
2a04:4e42:600::604
2a0b:4d07:101::1
34.120.92.56
35.186.220.184
37.252.173.27
54.220.8.206
54.75.54.75
54.81.167.22
54.82.195.36
68.67.153.60
0088c55fcbe4ccb2df59204288cece3aedac3efce32493bea627d68466148e2b
04fac4a0b1ae3f61cbddf6c63d60ad3b419dba7cfd817352c7dc1d2a00e8e48e
0603195f65053eabba0100568898b6d2f29a23dbe3c742391588f9cc5853028a
0ba0fbfb76e99495c054bc3ae1b7f31e32a98266995fe3cb27a767661c2e07df
0cb9b072cf2c8c5cabf1fc0ac2b02873e32a1ce13427655ce817cc294eea8fc9
1066c86165eb47cacbc55a34aa66bae28955f7deed5926249030f98b70af8031
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
139fc90823b96a757bba2c141df7fa3811af648b70cd294723a3dbb47cb13b1c
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
163c0afdbe5d2a296ee5a962b593854122fb42fb996c9cbbd388c5194aab0efe
16ad751a636637aa8f41bcefc85b257f201b3b87324994f6f418bb5835d3dd9c
17dc16f203a20131a9dfccce83ed74af83cb9da328011181ca745b7f3a883d08
1cc8aac593605d506c2f6443c77439ab1bd56c02f53cfcae401a6659ae90a6d3
20f73bc7302a48f92cc74f62598a5ad67a447f9e6c591fd653f1c89af4a5213c
2332c2b8154bc345a95686a194571690df8da39f14af3e3762decc72616c5c2e
28948159b803f5ff7f733581720bbae185968ee1f4f86dd3f2468902103d37fc
28e696f1e4297a65c928a3c82a163d9eacba8bea8725beea0b8aa2470dc88248
2ce04db8da4adcd3c61f4538252f865491c78e321bbb499909daa536ea95da24
2d8f4aebbb445c1037c1c719df07feaeb1f6ed06b277c039d31f17b42a9bac3f
2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110
303908648aeba5ba1158683235f83afbbaa98a391a4dc5b4c5ed4d819ba0c255
33702c30dd6e5f9c0a3a1ad110951d3c7cf9d60ff0afc05af77bcadf1ff97197
390aca4ba708128182c4802df7c4a1d3a85566b96bf2542caa3b4ea1f1507c1a
3afa935fb4eb58a3b6bd770368e79d91f7716722bc9d8c942a5495a27f33206c
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
401f533697cfb484598d2da76b5f4708bbca985a1fab42dbcfaa0741374d3245
42238934ecd53313e8dba8fc5ca2222496d084633c81171a5c70de5d849112af
4446e54d7bd0f4dbad541c2fcf0778d5fad8278020999a1a9c1f47838310c67b
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4da5da2f204eed8829fd9e0ee84e21479ee5db9fb5e6656d05bbdff54b2ce68e
5141b19e22fd4eb74b589aeeb44bad1d4acb56b018dd1794cc8d93d9f3487307
5156dff19f3da0b22f54fae9883fdc4a140ab79ec89aac752751e9fc643159bc
5325b3a490261a2328311929382f65726b725a767a39332a1b228367528bb7c8
551db934eceff097ce2ce5a79bd4defe542b37382692740f3ee34631cab54568
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5ba0d3ba78227870d68d1c34d01566d9c3eb7019cf4b4f2f069abf100ad235cb
615f2e915d6e55870aba23f2c73ddf30e8066a6b2d804878938eb4e0ae19353c
61eef10fb6867c58353af2e0686c6eeb1456520f33a4fcc7dcf18755c848a15b
65a47caa5183b035bf78d0f93adbe5cea500333410259c54abf2de356740df7e
6c161eaf631baf5bbdb7c35308da9ddac4d378263f6dd4423f3e3a2c86528fda
6cc0b251ec54fdd5cd55d98cbe7a7af00bd34f9cfd71fd01ca08c83121c89720
6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d
702396a93de43dacac67982c59314f5ae772e59e52a973027a31097e2143993b
71a41da894b51c66bad0e307a8ee51aa86ebf458433676b9c9ea8eb32f695d02
71cb5ad3dbda534886cdfb1980a588e3914a71a87e7e517df63c1abac8227772
72ec054f7c7d59fbcfb05fb876a1331171c993a1ecd83d325f434ce9d20cee6b
74f060fcb905d2e08f7adfba7ced8546345547ef52be4edd16b2010a1e7aada3
7724bf5c171c673ab3f574e6e6c3921668326904a0aa564d519c0e33e4d5b2f5
7777858e85646ef5fb3a61d3862af526216ae6f199db4bf1c6ad6b2fcde3bf47
7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7ed25b46fbeee4d58ba491483c894338542894bfb0ef81839514edf7a2657e58
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
863b0cb9d113013dae9dfced36761ed6de7d79632add96d70c8f2f2571f3e5e6
866fd0f98742f8922ccca3f48c527a43f7106544bc1831f8cb514d0e39200b57
868f2732413f5fcb021d726343ac249b6ca630db5fbd578f6525f279dda5c22b
8c34bc7bc1985e63394c3c2afff88cdcfc06e501320432dd23eaff83ea6754eb
91892af76d8bc88bb779fb1b99ae8d9a9a84d0ffa2b27c2ebf8c35b4ab3a0c83
92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8
93f2e0ec5bdac100d5c45192320aeae54aefd4e34064773d281ccad99ca2777a
9643ad4251cb0b5eac75b7141f9f2109fb2997b3ccfcbbab7ad11c8619adc0b8
973f99c63f827fdc720bfd039b2b654e2fdd78e33a7b690b54f4450224816ec3
98d30c45ea79d9eae8bdcdce751eb747cefcc4a331df431ba7702ccd6cf44c9f
9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a48260f238dfb9e6f4530e94e235fc5e97450d0933789322c532a64ee2701ace
a5de3651c0aa89e6497da505565c8944039fd6480aa161b1f270d1f5953c9d5f
a61d5737f270e877b7ee2e1ded35a5d6c07cb8e16e316c6a97a1d1dd9d76c1fd
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
abd979a2558bc92d17ef9c6c94d3d93e064cc2f029b85ddb8281eb3372f7253e
b02b20ba6ecbfd77a7b5951a906f6b9e230a607e2bd7002ae7ea79fcd7fdc1a3
b1347eb0f9062729600544cef00d2c1b8029c0e6bcc24822292fa0950c861ba0
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b25e835722ffbec8ab733d999dc194aa9ef7fcf00edc594e453f2823e0c65fb9
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b970be607d574f5ff825f40713871769073e788d7e2b117d4ff4e39820f850f5
c0da1fc9c1b23d76d5b0f9d3154f4141b30a6926b68523c37ec483dd0200945a
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c4191bdf74ac201d8071060b64d19ec9d284ee7512d5a08ecef16d99b787b9d2
ca2bc9c7cf7bc7dcaf47481abea6b29fcaeebc55b92b8df622f7feb4242c3ae7
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d2aeded44549c79579a1c22df5540256a9508410e5d1640fd20eb7cf8a0e65b2
d2e875a4cd800cf50dc0c0e37f3ce4e945ff600d25ad5274fb7889bb9d4be0d7
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d9df926b2a2ec4e88bbff3a55119b4fc5f2a9fd2d0fee71a12d8e67e03779b95
da0c1bc51d4ebfa2570f3e7546d9d3ccfb3f9d3c1199b1ca49869510aa79392a
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dbc2a7f895d05be1b17ed8eb1eb609589ff3b3f9b3e2ee97f9a9e530f9026b75
dc96c98b2419e72c35072ccb7d9b33b0aef45c2116eafc9c362b134db8c9b293
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd11c7626d5576d5cb2c3271bd2a20526c246da6c08c62248c8a944104edd9e7
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dfa7bb01d830f1d1ceb4c4d857e2c6f9de8f72c520f6ee031797d76af89989d8
dff1c95df1871fb00f4072de4333c7e4643c659dd8e8adbc746729eca62a98fc
e0ccd9072d23576c5e88acb4159d67dc4ce03d298e32b2fc51b91bc71ba5d56d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e49758209fb3df872d02169e1701d2a9ad52d687b41f99d9c3de3ef81304f867
e5ad1b24f290210e067ee5aeace152e7a510e2e457554bcada5e767292132747
e7c129ee5de51a2692632d98e0e18cbc092fb758635921e4ecc404293495fafa
eb5587a924cd997ae5ab4896d812257c47dae81e2b9b7a0a049b78cf32793968
eb8f35e2eb63ca25c5339c27b29feddac2eb36cb9709cf83dab3030a71d5d836
ec3783a450dbbff3e5c15673dc8ff4348cb71b818c43c18cb8e19bbe236c45fc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f051f186c88f8c27c42012b723552f3dda9ac61b295a0c2be0a58d15edd3bf68
f3a589d619416bd674e0fdbcc22738e611b488dde2167be30ec00886ec475ae0
f3d15fff8a4ea22a2137649a7935dc89776c66389936e50e4ba97895099459d6
f477c7dda86009c36f1b4a8b4e3619462ec80b5aa5095b6ba941138dd6a87428
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f8f977a83336826611839a21da4242f039359c753e6d3e0a825c63450c97f834
f92d6e79a7b51948eb161c71fefce09aa57c0bf009c8d326575950540304d49c
fb5a1fff57218742c5c1e469970504556a10d235b2379872b4ffcef9901d3bc0
fdd4315639b20e32f08bc16b37cddf4514c250e34601d29979eb4a2c471304ff
fe3cdb6342633b630a1636d3a83f1beb1aa5a9404078a93618f3235f4d609f6c

resources.perimeterx.com Open in urlscan Pro 100.24.141.224 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

194 Requests

92 %HTTPS

50 %IPv6

37 Domains

48 Subdomains

44 IPs

6 Countries

3614 kBTransfer

10895 kBSize

54 Cookies

2 Outgoing links

Page URL History

Redirected requests

194 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

resources.perimeterx.com Open in urlscan Pro
100.24.141.224 Public Scan

Screenshot
Live screenshot

Full Image

194
Requests

92 %
HTTPS

50 %
IPv6

37
Domains

48
Subdomains

44
IPs

6
Countries

3614 kB
Transfer

10895 kB
Size

54
Cookies

194 HTTP transactions
2 data transactions