blog.confiant.com Open in urlscan Pro
52.6.46.142 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Effective URL:
https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
Submission: On December 06 via api (December 6th 2019, 5:24:26 pm UTC) from CZ

Summary HTTP 59 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 12 IPs in 3 countries across 9 domains to perform 59 HTTP transactions. The main IP is 52.6.46.142, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is blog.confiant.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 29th 2019. Valid for: a year.

This is the only time blog.confiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 7	52.6.46.142 52.6.46.142	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	2606:4700::68... 2606:4700::6810:7c7f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a02:26f0:6c0... 2a02:26f0:6c00:181::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
30	2606:4700::68... 2606:4700::6810:7891	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:81b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	143.204.98.108 143.204.98.108	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	143.204.101.15 143.204.101.15	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	34.230.243.129 34.230.243.129	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2600:9000:204... 2600:9000:2043:2600:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2600:9000:20e... 2600:9000:20eb:c600:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	34.231.170.221 34.231.170.221	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
10	54.164.26.255 54.164.26.255	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
59	12

7 52.6.46.142 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-6-46-142.compute-1.amazonaws.com

blog.confiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7c7f (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:181::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2606:4700::6810:7891 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.108 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-98-108.fra50.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.15 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-15.fra50.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.230.243.129 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-230-243-129.compute-1.amazonaws.com

srv-2019-12-06-17.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2043:2600:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:20eb:c600:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.231.170.221 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-231-170-221.compute-1.amazonaws.com

errors.client.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 54.164.26.255 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-164-26-255.compute-1.amazonaws.com

collector-medium.lightstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	medium.com 1 redirects medium.com glyph.medium.com miro.medium.com cdn-client.medium.com	7 MB
10	lightstep.com collector-medium.lightstep.com	2 KB
7	confiant.com 1 redirects blog.confiant.com	39 KB
4	branch.io cdn.branch.io api2.branch.io	23 KB
3	optimizely.com cdn.optimizely.com errors.client.optimizely.com	81 KB
2	parsely.com srv-2019-12-06-17.pixel.parsely.com	765 B
2	google-analytics.com www.google-analytics.com	18 KB
1	app.link app.link	724 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	17 KB
59	9

	Domain	Requested by
16	miro.medium.com	blog.confiant.com cdn-client.medium.com
10	collector-medium.lightstep.com	cdn-client.medium.com
10	cdn-client.medium.com	blog.confiant.com cdn-client.medium.com
7	blog.confiant.com	1 redirects cdn-client.medium.com
4	glyph.medium.com	blog.confiant.com
3	api2.branch.io	cdn-client.medium.com
2	errors.client.optimizely.com	cdn-client.medium.com
2	srv-2019-12-06-17.pixel.parsely.com	d1z2jf7jlzjs58.cloudfront.net
2	www.google-analytics.com	blog.confiant.com
1	app.link	cdn.branch.io
1	cdn.branch.io	blog.confiant.com
1	d1z2jf7jlzjs58.cloudfront.net	cdn-client.medium.com
1	cdn.optimizely.com	blog.confiant.com
1	medium.com	1 redirects
59	14

This site contains links to these domains. Also see Links.

Domain
medium.com
ftlabs.github.io
vumhd.voluumtrk3.com
github.com
help.medium.com

Subject Issuer	Validity	Valid
blog.confiant.com Sectigo RSA Domain Validation Secure Server CA	`2019-08-29` - `2020-08-28`	a year	crt.sh
cdn.optimizely.com DigiCert ECC Secure Server CA	`2018-11-24` - `2020-02-23`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2019-12-02` - `2020-03-01`	3 months	crt.sh
appipv4.link Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA	`2018-09-24` - `2020-09-28`	2 years	crt.sh
*.lightstep.com Let's Encrypt Authority X3	`2019-09-24` - `2019-12-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
Frame ID: F73F1BD4058C5E44342FCA6F61EF6878
Requests: 63 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fhands-on-wit... HTTP 302
https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18 Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

59
Requests

100 %
HTTPS

50 %
IPv6

9
Domains

14
Subdomains

12
IPs

3
Countries

7673 kB
Transfer

9368 kB
Size

4
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/?source=post_page-----fa3c3623fd22----------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=post_page-----fa3c3623fd22---------------------nav_reg-
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=post_page-----fa3c3623fd22---------------------nav_reg-
Title: Get started

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=-2c3f3d52c6be-------------------------follow_byline-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/fa3c3623fd22/share/twitter?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/fa3c3623fd22/share/linkedIn?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/fa3c3623fd22/share/facebook?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=post_actions_header--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: http://ftlabs.github.io/fastclick/lib/fastclick.js
Title: http://ftlabs.github.io/fastclick/lib/fastclick.js

Search URL Search Domain Scan URL

URL: https://vumhd.voluumtrk3.com/9c3d790d-bfaa-4cd4-bf34-e5a96f9439a2?aff_sub2=c125cf67-0f90-49d0-b7eb-260db0b17b3b_1506652200&aff_sub3=MEDIAMATH-PR&aff_sub4=320x50&aff_sub6=freestar.io&domain=freestar.io&domain_id=96dfcc181c8499febe7e532c786e9968&campaign_country=SK_IOS
Title: https://vumhd.voluumtrk3.com/9c3d790d-bfaa-4cd4-bf34-e5a96f9439a2?aff_sub2=c125cf67-0f90-49d0-b7eb-260db0b17b3b_1506652200&aff_sub3=MEDIAMATH-PR&aff_sub4=320x50&aff_sub6=[REDACTED].io&domain=[REDACTED].io&domain_id=96dfcc181c8499febe7e532c786e9968&campaign_country=SK_IOS

Search URL Search Domain Scan URL

URL: https://github.com/ftlabs/fastclick
Title: https://github.com/ftlabs/fastclick

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=post_sidebar--------------------------follow_sidebar-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=post_sidebar-----fa3c3623fd22---------------------clap_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=post_actions_footer-----fa3c3623fd22---------------------clap_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/p/fa3c3623fd22/share/twitter?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/fa3c3623fd22/share/linkedIn?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/fa3c3623fd22/share/facebook?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=post_actions_footer--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=follow_footer-2c3f3d52c6be-------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&source=follow_footer--------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/fa3c3623fd22/responses/show?source=follow_footer--------------------------follow_footer-
Title: See responses (1)

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----fa3c3623fd22----------------------
Title: Discover Medium

Search URL Search Domain Scan URL

URL: https://medium.com/topics?source=post_page-----fa3c3623fd22----------------------
Title: Make Medium yours

Search URL Search Domain Scan URL

URL: https://medium.com/membership?source=post_page-----fa3c3623fd22----------------------
Title: Become a member

Search URL Search Domain Scan URL

URL: https://help.medium.com/?source=post_page-----fa3c3623fd22----------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.com/policy/9db0094a1e0f?source=post_page-----fa3c3623fd22----------------------
Title: Legal

Search URL Search Domain Scan URL

URL: https://medium.com/policy/f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22 HTTP 302
https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

59 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22 Show response
blog.confiant.com/
Redirect Chain

https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

159 KB
38 KB

1626ms
1626ms

Document
text/html

52.6.46.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.46.142 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-46-142.compute-1.amazonaws.com

Software

nginx /

Resource Hash

7a519a82589502decb33c5e7a556301a3e7d5253a760b0f6e86e4f8835f91717

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

:method: GET
:authority: blog.confiant.com
:scheme: https
:path: /hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Fri, 06 Dec 2019 17:24:05 GMT
content-type: text/html; charset=utf-8
set-cookie: optimizelyEndUserId=lo_Q9R2v0XLCH5Y; path=/; expires=Sat, 05 Dec 2020 17:24:03 GMT; secure uid=lo_Q9R2v0XLCH5Y; path=/; expires=Sat, 05 Dec 2020 17:24:03 GMT; secure; httponly sid=1:wKF3MD+GBoMdcNTGLI0Byz0do72Demjfzi0N1wSxGD5xSHt/g0Sfpz3dsTQwDGkR; path=/; expires=Sat, 05 Dec 2020 17:24:03 GMT; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; domain=blog.confiant.com; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; domain=.blog.confiant.com; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; domain=blog.confiant.com; secure; httponly, puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; domain=.blog.confiant.com; secure; httponly, puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; secure; httponly
sepia-upstream: production
x-frame-options: allow-from medium.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
medium-fulfilled-by: lite/release-20191206-023439-0e511c7-20191206-023518-8fe5a2b192, rito/master-20191205-225630-5b64922d39, tutu/medium-39470
etag: W/"27b15-EE5miTOnJLSwqNDaIKENCapRwks"
vary: Accept-Encoding
content-encoding: gzip
x-envoy-upstream-service-time: 1493

Redirect headers

status: 302
date: Fri, 06 Dec 2019 17:24:03 GMT
content-type: application/octet-stream
set-cookie: __cfduid=da9752d6d2b0ccf852e34ba952917d02a1575653043; expires=Sun, 05-Jan-20 17:24:03 GMT; path=/; domain=.medium.com; HttpOnly uid=lo_Q9R2v0XLCH5Y; Expires=Sat, 05-Dec-20 17:24:03 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly optimizelyEndUserId=lo_Q9R2v0XLCH5Y; path=/; expires=Sat, 05 Dec 2020 17:24:03 GMT; domain=.medium.com; secure sid=1:WY8nsD749AudnTEL9V02LsbxlKE72Qy+HaasSvB2KhkQwqrJYLILhCjCnvjh6hQp; path=/; expires=Sat, 05 Dec 2020 17:24:03 GMT; domain=.medium.com; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; domain=medium.com; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; domain=.medium.com; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; secure; httponly puid=; path=/; expires=Fri, 06 Dec 2019 17:24:02 GMT; domain=.medium.com; secure; httponly __cfruid=e1a22979ea478908c8d21cd8160d263d42a533dd-1575653043; path=/; domain=.medium.com; HttpOnly
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1575653043554:498616738d12
x-obvious-info: 39466-b7dc221,b7dc2218190
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
location: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
cf-ray: 540ff381d9ae59d6-VIE

GET
H2 200 16180790160.js Show response
cdn.optimizely.com/js/ 262 KB
81 KB 23ms
8ms Script
text/javascript 2a02:26f0:6c00:181::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16180790160.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:181::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c1a016e6b3abfea408847109cbb86e617d8fb01f408ff6d337afb560326ce589

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: .vk3V_MRkmHc6eo9BbB.9YMgjsimctcW
content-encoding: gzip
x-amz-request-id: F3E5E7ABB60C6ACD
status: 200
access-control-max-age: 86400
date: Fri, 06 Dec 2019 17:24:05 GMT
x-amz-replication-status: COMPLETED
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="4";dur=0,cdnip;desc="2a02:26f0:6c00:181::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
content-length: 81873
x-amz-id-2: dWylMxnVsc2Nay9GWxhP1bi4fRtWPQvEOMBP1bAPSdinQwejpR+8EsMg1k10sxAFzRHDZAoxrNQ=
last-modified: Fri, 06 Dec 2019 00:34:10 GMT
server: AmazonS3
etag: "903c1814b501fa6a2a1c830825f41f76"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 622
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 44 KB
29 KB 33ms
32ms Stylesheet
text/css 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1599
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 540ff38d2fb4cbc0-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Fri, 06 Dec 2019 21:24:05 GMT

GET
H2 200 1*lwwdz5iU5bY2ZzaF5qP-Hw.png
miro.medium.com/max/174/ 8 KB
8 KB 181ms
180ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/174/1*lwwdz5iU5bY2ZzaF5qP-Hw.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7b291bac4cab78306a75e1a45638905656722c05eea8ddf56f41048bbd7588a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3214-055879b
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 7844
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff38d2feacbac-VIE
expires: Sun, 05 Jan 2020 17:24:05 GMT

GET
H2 200 1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/96/96/ 17 KB
18 KB 344ms
343ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/96/96/1*6g6sWeOzruzLd-7jotXC9A.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d0802dae7dcd24caf6e0b7476de116171c46c668553fd8306dad94d14c9de092

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3210-6a9380d
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 17899
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff38d2fedcbac-VIE
expires: Sun, 05 Jan 2020 17:24:05 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 3028
date: Fri, 06 Dec 2019 16:33:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Fri, 06 Dec 2019 18:33:37 GMT

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.confiant.com

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
14 KB 275ms
275ms Font
application/font-woff 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.confiant.com

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 540ff38d6864595e-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
111 B 13ms
13ms Image
image/gif 2a00:1450:4001:81b::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1764013236&t=pageview&_s=1&dl=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22%3Fgi%3D141aea2fd18&ul=en-us&de=UTF-8&dt=Hands%20On%20With%20Malvertisers%E2%80%99%20Sneaky%20Tricks%20-%20Confiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1327959170&gjid=1506804479&cid=1422484418.1575653045&tid=UA-24232453-2&_gid=1739922040.1575653045&_r=1&z=807941032

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1*roedigbmFjRYkZobdZWuKg.jpeg
miro.medium.com/max/60/ 924 B
1 KB 38ms
38ms Image
image/jpeg 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*roedigbmFjRYkZobdZWuKg.jpeg?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

31b828553dee0047558a9701a9efb421703e4d11e61423b5c9021b7a5ea90dee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1503177
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 924
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff38da9fbcbac-VIE
expires: Sun, 05 Jan 2020 17:24:05 GMT

GET
H2 200 0*HL__NQJ1xdTK7GQt.
miro.medium.com/max/46/ 752 B
842 B 557ms
557ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/46/0*HL__NQJ1xdTK7GQt.?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

a4d82b27cde96c8375ac245162991022533b3ddf0630dd830cdc7f987578dcbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3216-39bf470
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 752
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff38da9fdcbac-VIE
expires: Sun, 05 Jan 2020 17:24:05 UTC

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.confiant.com

Response headers

Content-Type: font/opentype

GET
H2 200 charter-400-italic.woff
glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
11 KB 137ms
137ms Font
application/font-woff 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-400-italic.woff

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.confiant.com

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 540ff38db8a2595e-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
14 KB 176ms
176ms Font
application/font-woff 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.confiant.com

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 540ff38db8a4595e-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 0*J3FyurrYcpJWDlYn.
miro.medium.com/max/60/ 796 B
940 B 245ms
244ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*J3FyurrYcpJWDlYn.?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

bfca2a8d5ee2deee441a83440778e442f03ced1f0b3a99c4774afdb5e49ac409

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3216-39bf470
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 796
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff38dca80cbac-VIE
expires: Sun, 05 Jan 2020 17:24:05 UTC

GET
H2 200 1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/160/160/ 40 KB
40 KB 244ms
244ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*6g6sWeOzruzLd-7jotXC9A.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

c2095b78ac8bde0c5108f90dfb38de9132f193bbf29ae55eff39e07a5514c31c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 41314
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff38dca83cbac-VIE
expires: Sun, 05 Jan 2020 17:24:05 GMT

GET
H2 200 1*Gzx_yxzR1l1GX0h8J75gfQ.png
miro.medium.com/fit/c/160/160/ 9 KB
9 KB 221ms
221ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*Gzx_yxzR1l1GX0h8J75gfQ.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

f25e38427a40e8d86aee0f6077a7dc2e8d2178a3e93d18b9e11abe025f2809cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 8946
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff38deae0cbac-VIE
expires: Sun, 05 Jan 2020 17:24:05 GMT

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.confiant.com

Response headers

Content-Type: font/opentype

GET
H2 200 manifest.d32c7b43.js Show response
cdn-client.medium.com/lite/static/js/ 4 KB
2 KB 23ms
22ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.d32c7b43.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

87ac59eca5db99bd0082ea9897a560c5511b82ec0836c91d2f20319aa8d01b1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 62188
cf-ray: 540ff38dfb0ecbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: F82AED446608DF64
x-amz-id-2: JiYsEKGrZr5wQUl/5yYpVQ+FUbvPZiqgWfpwm4wETr4s+baB1olpFjqvjogPncqNUmPOvWd70aI=
last-modified: Thu, 05 Dec 2019 23:54:52 GMT
server: cloudflare
etag: W/"6ac1b5ae97f3810071a99c0c271b6aa8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: UwbiKd0XydAv6bPqMLg.Ac6mOtnbWTxT
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 vendors~main.e8623421.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 756 KB
198 KB 208ms
207ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd238b9e273430f65af5122becb19093ca1e3ab29982443b2265f3b63cb4e77c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 228367
cf-ray: 540ff38e0b11cbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: D99AE3376D865483
x-amz-id-2: b98skupiAITMVVM4SCaaRGrHBVS95UZF6Ax6g1mkiGwTB6nlswj/1VYKjUwJQ0KPt9K1uUFQsC8=
last-modified: Wed, 04 Dec 2019 01:48:00 GMT
server: cloudflare
etag: W/"6de4bf4c410aab215dd26fb03c8f0a5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: qVt9sQ8Jq7KDmVYGce7cCl7dJGRnJX99
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 main.a0ddfe45.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 421 KB
96 KB 92ms
91ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.a0ddfe45.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

338801b84e6f1b4a84ed76362d5cf6ee4b3a8808a7172de73e13669620cdeb35

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 50079
cf-ray: 540ff38e0b13cbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: B9F877B82D692786
x-amz-id-2: zUpFAaJL3Q6+5TTlKVJ4YI0U799GMhVjC8tQiclxH1k9ioRa/LTGY/sFpxwBFxISY4vljGWi+Sk=
last-modified: Fri, 06 Dec 2019 03:06:26 GMT
server: cloudflare
etag: W/"15ada12f054a810d5bf9b17b0ecca2f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: M.XAyaop4nyui6Pa0zuwN1OUJ8Enz2qv
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 38 KB
16 KB 209ms
208ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 69090
cf-ray: 540ff38e0b14cbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 29F3D495C30F835E
x-amz-id-2: MvWcRT51ZvS5o6QdG0DhPHf3r/WRxyq7WGy+W7T/kThgEmeUqKQ66Yf1JrrPffgWAPWRpwtf324=
last-modified: Thu, 05 Dec 2019 21:58:46 GMT
server: cloudflare
etag: W/"8b9fec58d0bdfd692d5c65e3b37f33bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: sJq85UZn_PUcguJu9c1aJgvrnhAD7C9I
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.4906a8cb.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
6 KB 57ms
56ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.4906a8cb.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

72d261763350d3720c13298ee9bba55513f0fd3b8ca5b4a501c8c02bdbb6eb9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 69090
cf-ray: 540ff38e0b1acbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: EB1CF4B84E0E9327
x-amz-id-2: i4SZHKTT9NRGLgv4NprZk5OP7ocWFS0vLQJL6lT32mvkiwvMf4teJdZ0Dpkf0o/vLCUX2osoJEM=
last-modified: Thu, 05 Dec 2019 21:58:39 GMT
server: cloudflare
etag: W/"58b79f31f91121d855725928e7f91fdf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: IA6wg1e7Dd9BZ_F.p4w62mkGx3LHyfoP
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.1ff1b026.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 117 KB
31 KB 208ms
207ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.1ff1b026.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7f7a41c920e7dc0aa09ef8c1ddfb983bbac2471e8b727b2ad775e619abfd686

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 69090
cf-ray: 540ff38e0b1bcbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 00D878995A3106E2
x-amz-id-2: oNoAWLOQ5v0oezz79JqLXlh4kqSk1U2uhR7/pV5sA4dp57dGviudPTn5fX9KA1oqwr7cp10K6fw=
last-modified: Thu, 05 Dec 2019 21:58:39 GMT
server: cloudflare
etag: W/"7c8eda42c9d4cba931392e5e5d4f0dc8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 4WUIHccHxDvowN2NL8CB18A2NPS22_w.
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.2642aefb.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 49 KB
15 KB 186ms
186ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.2642aefb.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fda6e95ace85d5162d1ad594d7d1d3042ccf9b71a2bf53f061343411fb2f496f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 69090
cf-ray: 540ff38e2b8acbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 903217DC7FE9EB13
x-amz-id-2: 1/n48ULlmDkZVr2k6PoUMrqzv/H1D9Tzsc5sN0L4VszVjuQoC4byPN2YE5JxQqrJ+eT1W8r/FDY=
last-modified: Thu, 05 Dec 2019 21:58:43 GMT
server: cloudflare
etag: W/"6c279eb4873203f4bc24d7e238f5e814"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: n8cUg1jGA2KCGil1TrTIw9aIfj6xn4aK
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 screen.post.80412234.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 253 KB
59 KB 151ms
151ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post.80412234.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

06f54be5bfbdde2565d42a03fd6a3f986b9cb43018eb7174701f14771602e5d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 69090
cf-ray: 540ff38e5c1ecbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: C055EFEA86281A67
x-amz-id-2: DErm39aCwZzdmZVcVgmSk7BBHw61C4ljGT3uphIv71UU4p/UJpIBthtVz8WJ7WWG4TRCpUg6hU8=
last-modified: Thu, 05 Dec 2019 21:58:40 GMT
server: cloudflare
etag: W/"c4019e8f8be0afe000fcbf0235e3a1bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: kVDSye8O0OxYio27buF3sOeVQuL_wngz
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

POST
H2 200 client-ready
blog.confiant.com/_/lite/performance/ 2 B
0 92ms
92ms Fetch
text/plain 52.6.46.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/lite/performance/client-ready

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a0ddfe45.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.46.142 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-46-142.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 1
medium-fulfilled-by: lite/release-20191206-023439-0e511c7-20191206-023518-8fe5a2b192
content-length: 2

GET
H2 200 vendors~tracing.0154598a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 62 KB
16 KB 26ms
26ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~tracing.0154598a.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.d32c7b43.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

037593f8fd10db1df005e17412f8d42274315767d03f74230a52f1871f03b7c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 233200
cf-ray: 540ff390baadcbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 4259B6AA64B64BD8
x-amz-id-2: KfkLj7XKGw/gm88B42YisAUjxDNXTnArE0yo5hod8Ngh2EdjrhU/TbgmPu+NMg1Xj/rnIJO4+CI=
last-modified: Wed, 04 Dec 2019 00:24:14 GMT
server: cloudflare
etag: W/"afcbddc62374f70c228505b2f1591bc7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: IMxz6jNiD0LVohM5OAWO2A9nZPB2dGMP
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

GET
H2 200 tracing.075b133f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 2 KB
1 KB 21ms
21ms Script
application/javascript 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/tracing.075b133f.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.d32c7b43.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

57416757e1bde9b95d0c6afb6f7c4a3353119a5793d69076b74df7d0dfee8127

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 69089
cf-ray: 540ff390bab1cbac-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 0BE0408195AFACA0
x-amz-id-2: c7gRio+3FPFCOrLOry2KRKS4PSucVqz1CZ8l8J2nnM5GpPcquqjiawaQwgc/jQ7LhdpAGjtX0H0=
last-modified: Thu, 05 Dec 2019 21:58:45 GMT
server: cloudflare
etag: W/"aaaeeaf00e1dcd42155129dcb4d66d23"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 4G.1P9JcOjuvfCbapU..TfY1z_AG_4qx
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Sat, 05 Dec 2020 17:24:05 GMT

POST
H2 200 graphql Show response
blog.confiant.com/_/ 23 B
290 B 141ms
141ms Fetch
application/json 52.6.46.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.46.142 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-46-142.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 200b0d8fe8fe88aa3678c4a7b0bc5dcd391a7fac8d091103acd20f15a0244c00

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Medium-Frontend-App: lite/release-20191206-023439-0e511c7-20191206-023518-8fe5a2b192
apollographql-client-version: release-20191206-023439-0e511c7-20191206-023518-8fe5a2b192

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
sepia-upstream: production
server: nginx
etag: W/"17-jFAB8lIUHV6I3JuU9U/ODIAxxmw"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20191205-225630-5b64922d39, tutu/medium-39470
x-envoy-upstream-service-time: 48
content-length: 23
x-request-received-at: 1575653046060

POST
H2 200 graphql Show response
blog.confiant.com/_/ 23 B
290 B 131ms
131ms Fetch
application/json 52.6.46.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.6.46.142 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-46-142.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 200b0d8fe8fe88aa3678c4a7b0bc5dcd391a7fac8d091103acd20f15a0244c00

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation: PostRecircQuery
content-type: application/json
accept: */*
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Medium-Frontend-App: lite/release-20191206-023439-0e511c7-20191206-023518-8fe5a2b192
apollographql-client-version: release-20191206-023439-0e511c7-20191206-023518-8fe5a2b192

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
sepia-upstream: production
server: nginx
etag: W/"17-jFAB8lIUHV6I3JuU9U/ODIAxxmw"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20191205-225630-5b64922d39, tutu/medium-39470
x-envoy-upstream-service-time: 38
content-length: 23
x-request-received-at: 1575653046172

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 41 KB
17 KB 26ms
11ms Script
application/x-javascript 143.204.98.108
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a0ddfe45.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.98.108 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-98-108.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 05 Dec 2019 18:19:13 GMT
Content-Encoding: gzip
Age: 83096
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 07 Oct 2019 18:17:48 GMT
Server: nginx
ETag: "5d9b814c-a469"
Content-Type: application/x-javascript
Via: 1.1 6b8ac2d6d64dc42007741d312e2d73ab.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA50-C1
X-Amz-Cf-Id: 5IT-Cgv8y59cSO4Xn3Phs8lAbb-6RVw-JVQ5kdkIeQlmb_B3wk1tBQ==
Expires: Fri, 06 Dec 2019 18:19:06 GMT

GET
H2 200 1*lwwdz5iU5bY2ZzaF5qP-Hw.png
miro.medium.com/max/87/ 3 KB
3 KB 230ms
230ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/87/1*lwwdz5iU5bY2ZzaF5qP-Hw.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d6aecc3e017162f65188ea2b29fb05b279905deee5ab8d4ce3615a32bfe2c6ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3197-fb89d63
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 2717
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff392d983cbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 GMT

GET
H2 200 1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/48/48/ 5 KB
5 KB 132ms
132ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/48/48/1*6g6sWeOzruzLd-7jotXC9A.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

fc48993b1bbff13e6bb10c2e7d4f6a63ab4ee30c68b5683919e089dee8bc443e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 5241
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff392d987cbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 GMT

GET
H2 200 1*roedigbmFjRYkZobdZWuKg.jpeg
miro.medium.com/max/30/ 671 B
1 KB 126ms
125ms Image
image/jpeg 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*roedigbmFjRYkZobdZWuKg.jpeg?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

c0290921279eaee8b43542d3a12e9e6c6a5e1f0fa20c0f228afb6efd26a62c8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3210-6a9380d
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 671
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff392d988cbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 GMT

GET
H2 200 0*HL__NQJ1xdTK7GQt.
miro.medium.com/max/23/ 377 B
442 B 198ms
198ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/23/0*HL__NQJ1xdTK7GQt.?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

041ccd0e7cdd672fe3abf58ea0b01a0679093cbb509c85cd2d9fd1476e8bc409

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3216-39bf470
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 377
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff392d989cbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 UTC

GET
H2 200 0*J3FyurrYcpJWDlYn.
miro.medium.com/max/30/ 377 B
469 B 180ms
179ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*J3FyurrYcpJWDlYn.?q=20

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

022d15aab391ffcd0e7f4047552290c9a0ed48c356b7bff59bb5087c61765f42

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3216-39bf470
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 377
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff392d98acbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 UTC

GET
H2 200 1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/80/80/ 13 KB
13 KB 141ms
141ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*6g6sWeOzruzLd-7jotXC9A.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

5c184d9155e9fa62111bdee27d27bb0b316f24b966089342d0e49b5134166432

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 12849
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff392d98ccbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 GMT

GET
H2 200 1*Gzx_yxzR1l1GX0h8J75gfQ.png
miro.medium.com/fit/c/80/80/ 4 KB
4 KB 139ms
139ms Image
image/png 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*Gzx_yxzR1l1GX0h8J75gfQ.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7de86495b2cc2bb8cb0114b62861ee7775a0ce3aa22177bf11adf33135933fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3197-fb89d63
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 3769
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff3939bcdcbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 GMT

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 72 KB
22 KB 46ms
18ms Script
text/javascript 143.204.101.15
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22?gi=141aea2fd18
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.15 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-15.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e013976876f923b5d747b79501cd38255f1876399c5e9b5a8f995dec0291ab7

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: z8HvpISR3mptTBbKeuNdWa0yABs8A72w
Content-Encoding: gzip
Last-Modified: Tue, 29 Oct 2019 00:06:03 GMT
Server: AmazonS3
Age: 71
ETag: "18c281260fef78c97f0b9613cfd9df40"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 055d899361491602a9ef1eb0cdc5e337.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Fri, 06 Dec 2019 17:22:56 GMT
X-Amz-Cf-Pop: FRA50-C1
Connection: keep-alive
Content-Length: 21884
X-Amz-Cf-Id: I4MGUZT2GiaHoIgRqQeUwzINb1FEpCLBwpK5l0dlz_Wd2Z2rQE9_Yg==

GET
H2 200 1*roedigbmFjRYkZobdZWuKg.jpeg
miro.medium.com/max/5760/ 3 MB
3 MB 148ms
148ms Image
image/jpeg 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/5760/1*roedigbmFjRYkZobdZWuKg.jpeg

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

0d3ccec87547984955d3d2ec4b777b5db1a205708e80c7535b681e761090847e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 3503940
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff393abffcbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 GMT

GET
H/1.1 200
OK / Show response
srv-2019-12-06-17.pixel.parsely.com/start/ 77 B
380 B 349ms
87ms Script
application/json 34.230.243.129
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2019-12-06-17.pixel.parsely.com/start/?rand=1575653046310&plid=70647009&idsite=medium.com&url=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&sref=&sts=1575653046294&slts=0&title=Hands+On+With+Malvertisers%E2%80%99+Sneaky+Tricks+-+Confiant&date=Fri+Dec+06+2019+18%3A24%3A06+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=78516192&callback=parselyStartCallback
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.243.129 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-230-243-129.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e66a0515f91d1b8bf2d65f7f9e305ac823d56bc55d674a9910d9f116b7db234f

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 06 Dec 2019 17:24:06 GMT
Server: nginx
Connection: keep-alive
Content-Type: application/json
Content-Length: 77
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
724 B 324ms
303ms Script
text/javascript 2600:9000:2043:2600:19:9934:6a80:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.52.2&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:2043:2600:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

6b5922033143e890fd757aa4003f9e6b783689ca324b5107113518f8d0af7390

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 06 Dec 2019 17:24:06 GMT
Via: 1.1 e7ce333c56f455a0dae7f1f5ea5d6086.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Amz-Cf-Pop: FRA54
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-GtXWHr66vmX8+BQRTXMpI0JscQM"
X-Amz-Cf-Id: W0WjfGcmAqhOpBjTs1r0b_owB3yo8EeR5cvgZ_hzNrl22AAboEafLg==

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
599 B 161ms
160ms XHR
application/json 2600:9000:20eb:c600:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:c600:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: 01ce5a838c17a33702d26d193a781813389ffee817c92d41bc383a3572631b67

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA2-C1
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: h19nWF2oi6lbhC4YE-ETlhi6tGXHXGtwDrqTA7yvw_Img0zEn6ExDQ==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
361 B 167ms
167ms XHR
application/json 2600:9000:20eb:c600:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:c600:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA2-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: V9E8Xf-KRKCkwYuzYtPWaeOerbsAA3K8tdIzQOc8Hzj1MS9LtkO4Tw==

OPTIONS
H/1.1 200
OK log Show response
errors.client.optimizely.com/ 13 B
409 B 352ms
89ms XHR
text/plain 34.231.170.221
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.231.170.221 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-231-170-221.compute-1.amazonaws.com
Software: /
Resource Hash: 16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.confiant.com
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Fri, 06 Dec 2019 17:24:07 GMT
Allow: POST,OPTIONS
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://blog.confiant.com
Access-Control-Max-Age: 1800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Content-Length: 13

POST
H2 200 render
blog.confiant.com/_/lite/performance/ 2 B
0 92ms
92ms Fetch
text/plain 52.6.46.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/lite/performance/render

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a0ddfe45.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.46.142 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-46-142.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 1
medium-fulfilled-by: lite/release-20191206-023439-0e511c7-20191206-023518-8fe5a2b192
content-length: 2

GET
H2 200 1*roedigbmFjRYkZobdZWuKg.jpeg
miro.medium.com/max/5760/ 3 MB
3 MB 32ms
32ms Image
image/jpeg 2606:4700::6810:7891
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/5760/1*roedigbmFjRYkZobdZWuKg.jpeg

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

0d3ccec87547984955d3d2ec4b777b5db1a205708e80c7535b681e761090847e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Dec 2019 17:24:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 0
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 3503940
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 540ff3979909cbac-VIE
expires: Sun, 05 Jan 2020 17:24:06 GMT

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
362 B 183ms
183ms XHR
application/json 2600:9000:20eb:c600:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:c600:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 06 Dec 2019 17:24:07 GMT
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA2-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: CLBSkPRXXxhuRAJj6DNvJK7_vv2qfGLtt-yZgcuHvsa_Ky180VdH7w==

POST
H/1.1 204
No Content log Show response
errors.client.optimizely.com/ 0
243 B 88ms
87ms XHR
text/plain 34.231.170.221
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.231.170.221 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-231-170-221.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://blog.confiant.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Connection: keep-alive
Date: Fri, 06 Dec 2019 17:24:07 GMT
Content-Type: text/plain

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 289ms
87ms XHR
text/plain 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.confiant.com
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Fri, 06 Dec 2019 17:24:07 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 88ms
88ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: 25b7c91736d360e71e167bb2f9a28721a68c6198b38a7771a2466f3310510be7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Fri, 06 Dec 2019 17:24:07 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 88ms
88ms XHR
text/plain 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.confiant.com
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Fri, 06 Dec 2019 17:24:08 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 88ms
87ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: b0a10a2d905e3a74d80f293a94a2c730055a522ca48992d637614c578c1eed46

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Fri, 06 Dec 2019 17:24:08 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 87ms
87ms XHR
text/plain 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.confiant.com
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Fri, 06 Dec 2019 17:24:08 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 88ms
88ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: 7e6a2741a9ad5a7b46613e25a6a879a7be97c56efd908dc8e4e83fe64ff45d99

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Fri, 06 Dec 2019 17:24:08 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 87ms
87ms XHR
text/plain 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.confiant.com
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Fri, 06 Dec 2019 17:24:09 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 88ms
88ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: c188e498815a51eb274170ba76554f179331d9b683421b49c9382d0d61aefa46

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Fri, 06 Dec 2019 17:24:09 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 409 batch
blog.confiant.com/_/ 10 KB
0 141ms
141ms Fetch
text/html 52.6.46.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/batch

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.a0ddfe45.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.6.46.142 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-6-46-142.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://blog.confiant.com https://.blog.confiant.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
x-xsrf-token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: application/json

Response headers

content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://blog.confiant.com https://*.blog.confiant.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 39466-b7dc221,b7dc2218190
status: 409
content-length: 10152
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1575653050926:7e1587a21145
server: nginx
date: Fri, 06 Dec 2019 17:24:10 GMT
x-frame-options
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 87ms
87ms XHR
text/plain 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.e8623421.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.confiant.com
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Fri, 06 Dec 2019 17:24:12 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 89ms
88ms XHR
application/json 54.164.26.255
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-26-255.compute-1.amazonaws.com
Software: /
Resource Hash: 5e1ce65ffcd5f884d8d96dd61658c0231305a3237b390fcf270c96d30decab94

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
Origin: https://blog.confiant.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Fri, 06 Dec 2019 17:24:12 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

GET
H/1.1 200
OK /
srv-2019-12-06-17.pixel.parsely.com/event/ 43 B
385 B 266ms
87ms Image
image/gif 34.230.243.129
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2019-12-06-17.pixel.parsely.com/event/?rand=1575653056809&plid=70647009&idsite=medium.com&url=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fblog.confiant.com%2Fhands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22&sref=&sts=1575653056808&slts=0&date=Fri+Dec+06+2019+18%3A24%3A16+GMT%2B0100+(Central+European+Standard+Time)&action=heartbeat&inc=5&tt=4900&pvid=78516192&u=pid%3D6a35bda02546bf86a56d37838eb4edf6
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.243.129 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-230-243-129.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 06 Dec 2019 17:24:17 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="CUR ADM OUR NOR STA NID"

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.confiant.com/	1970-01-19 05:40:54	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://blog.confiant.com/hands-on-with-malvertisers-sneaky-tricks-fa3c3623fd22%22%2C%22sref%22:%22%22%2C%22sts%22:1575653046294%2C%22slts%22:0}
.confiant.com/	1970-01-19 15:10:17	Name: _parsely_visitor Value: {%22id%22:%22pid=6a35bda02546bf86a56d37838eb4edf6%22%2C%22session_count%22:1%2C%22last_session_ts%22:1575653046294}
blog.confiant.com/	1970-01-19 05:50:57	Name: lightstep_session_id Value: 16bf04ab78040fcf
blog.confiant.com/	1970-01-19 05:50:57	Name: lightstep_guid/lite-web Value: 35e5191d768aead5

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.a0ddfe45.chunk.js(Line 1) Message: -+++++= .+++++= .+@@@@@+ #@@@@: .@@@@@= @@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ @@@@-%: @@@@@ @ @@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.a0ddfe45.chunk.js(Line 1) Message: We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
blog.confiant.com
cdn-client.medium.com
cdn.branch.io
cdn.optimizely.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
errors.client.optimizely.com
glyph.medium.com
medium.com
miro.medium.com
srv-2019-12-06-17.pixel.parsely.com
www.google-analytics.com
143.204.101.15
143.204.98.108
2600:9000:2043:2600:19:9934:6a80:93a1
2600:9000:20eb:c600:11:f728:3040:93a1
2606:4700::6810:7891
2606:4700::6810:7c7f
2a00:1450:4001:81b::200e
2a02:26f0:6c00:181::13b8
34.230.243.129
34.231.170.221
52.6.46.142
54.164.26.255
01ce5a838c17a33702d26d193a781813389ffee817c92d41bc383a3572631b67
022d15aab391ffcd0e7f4047552290c9a0ed48c356b7bff59bb5087c61765f42
037593f8fd10db1df005e17412f8d42274315767d03f74230a52f1871f03b7c4
041ccd0e7cdd672fe3abf58ea0b01a0679093cbb509c85cd2d9fd1476e8bc409
06f54be5bfbdde2565d42a03fd6a3f986b9cb43018eb7174701f14771602e5d4
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
0d3ccec87547984955d3d2ec4b777b5db1a205708e80c7535b681e761090847e
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
200b0d8fe8fe88aa3678c4a7b0bc5dcd391a7fac8d091103acd20f15a0244c00
25b7c91736d360e71e167bb2f9a28721a68c6198b38a7771a2466f3310510be7
31b828553dee0047558a9701a9efb421703e4d11e61423b5c9021b7a5ea90dee
338801b84e6f1b4a84ed76362d5cf6ee4b3a8808a7172de73e13669620cdeb35
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173
57416757e1bde9b95d0c6afb6f7c4a3353119a5793d69076b74df7d0dfee8127
58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad
5c184d9155e9fa62111bdee27d27bb0b316f24b966089342d0e49b5134166432
5e1ce65ffcd5f884d8d96dd61658c0231305a3237b390fcf270c96d30decab94
6b5922033143e890fd757aa4003f9e6b783689ca324b5107113518f8d0af7390
72d261763350d3720c13298ee9bba55513f0fd3b8ca5b4a501c8c02bdbb6eb9c
7a519a82589502decb33c5e7a556301a3e7d5253a760b0f6e86e4f8835f91717
7b291bac4cab78306a75e1a45638905656722c05eea8ddf56f41048bbd7588a9
7de86495b2cc2bb8cb0114b62861ee7775a0ce3aa22177bf11adf33135933fde
7e6a2741a9ad5a7b46613e25a6a879a7be97c56efd908dc8e4e83fe64ff45d99
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87ac59eca5db99bd0082ea9897a560c5511b82ec0836c91d2f20319aa8d01b1f
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
9e013976876f923b5d747b79501cd38255f1876399c5e9b5a8f995dec0291ab7
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a4d82b27cde96c8375ac245162991022533b3ddf0630dd830cdc7f987578dcbf
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
b0a10a2d905e3a74d80f293a94a2c730055a522ca48992d637614c578c1eed46
bfca2a8d5ee2deee441a83440778e442f03ced1f0b3a99c4774afdb5e49ac409
c0290921279eaee8b43542d3a12e9e6c6a5e1f0fa20c0f228afb6efd26a62c8e
c188e498815a51eb274170ba76554f179331d9b683421b49c9382d0d61aefa46
c1a016e6b3abfea408847109cbb86e617d8fb01f408ff6d337afb560326ce589
c2095b78ac8bde0c5108f90dfb38de9132f193bbf29ae55eff39e07a5514c31c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0802dae7dcd24caf6e0b7476de116171c46c668553fd8306dad94d14c9de092
d6aecc3e017162f65188ea2b29fb05b279905deee5ab8d4ce3615a32bfe2c6ea
d7f7a41c920e7dc0aa09ef8c1ddfb983bbac2471e8b727b2ad775e619abfd686
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dd238b9e273430f65af5122becb19093ca1e3ab29982443b2265f3b63cb4e77c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e66a0515f91d1b8bf2d65f7f9e305ac823d56bc55d674a9910d9f116b7db234f
ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367
f25e38427a40e8d86aee0f6077a7dc2e8d2178a3e93d18b9e11abe025f2809cd
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
fc48993b1bbff13e6bb10c2e7d4f6a63ab4ee30c68b5683919e089dee8bc443e
fda6e95ace85d5162d1ad594d7d1d3042ccf9b71a2bf53f061343411fb2f496f

blog.confiant.com Open in urlscan Pro 52.6.46.142 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

59 Requests

100 %HTTPS

50 %IPv6

9 Domains

14 Subdomains

12 IPs

3 Countries

7673 kBTransfer

9368 kBSize

4 Cookies

28 Outgoing links

Page URL History

Redirected requests

59 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.confiant.com Open in urlscan Pro
52.6.46.142 Public Scan

Screenshot
Live screenshot

Full Image

59
Requests

100 %
HTTPS

50 %
IPv6

9
Domains

14
Subdomains

12
IPs

3
Countries

7673 kB
Transfer

9368 kB
Size

4
Cookies

59 HTTP transactions
4 data transactions