us.norton.com Open in urlscan Pro
23.202.152.165 Public Scan

a23-200-3-68.deploy.static.akamaitechnologies.com

Software

Google Tag Manager /

Resource Hash

505b485b7222c182d6df4ad044b197d82f66a0c0c7c1af47b2abdd82690f18a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87154
x-xss-protection: 0
last-modified: Wed, 10 Jul 2024 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 10 Jul 2024 21:53:03 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 28 KB
9 KB 174ms
38ms Script
application/x-javascript 23.72.185.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.72.185.137 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-72-185-137.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cca10b0a6a233fa35be784759c50f8b38678231181c9ee6c9b8b909a43c224ac

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Wed, 10 Jul 2024 21:53:03 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Jul 2024 10:44:21 GMT
Server: AkamaiNetStorage
ETag: "85a9af967f02eefdbebbd46ff40e99c4:1720522982.06149"
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-RG: NA
Cache-Control: max-age=1200
X-CC: CA
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8619
Expires: Wed, 10 Jul 2024 22:13:03 GMT

GET
H2 200 / Show response
websdk.appsflyer.com/ 51 KB
14 KB 177ms
46ms Script
application/javascript 18.160.10.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://websdk.appsflyer.com/?st=banners&
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-75.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ce6d7f008824d9f6af00150bf70a49369a24381165b5808efa74e68518e6d58d

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:49:25 GMT
content-encoding: br
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
last-modified: Wed, 14 Jun 2023 06:58:46 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
age: 219
x-amz-server-side-encryption: AES256
etag: W/"ad6e8ace01357e7c84957fc6fc296d42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: LoW_6jpBs6dPN1i1v840Wv-h_HjyBtoNIcRFKZYScu8gAmA5FJeR8g==

GET
H2 200 8d08b1cf12b6dedd46c680b7d1eca911.js Show response
spider.australiarevival.com/i/ 103 KB
38 KB 175ms
43ms Script
text/javascript 52.84.125.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://spider.australiarevival.com/i/8d08b1cf12b6dedd46c680b7d1eca911.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.125.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-125-114.ord53.r.cloudfront.net
Software: Caddy /
Resource Hash: 959181664c15aa823c84b44774f3ecc12744f25b458d7a51eebd7af64b17bee6

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:18:09 GMT
content-encoding: gzip
via: 1.1 988980199a49ca441b34454350b1dfe4.cloudfront.net (CloudFront)
server: Caddy
x-amz-cf-pop: ORD53-C1
age: 2094
etag: "19b8a-zH/PeLoOzNL69uB+YzfTPMsC6tU"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=43200
content-length: 38472
x-amz-cf-id: NgUR-ZFhN4-D9OHSnViCdJ0kR5dJZHdXZJ4g66967nTWemJgEDyJJg==
expires: Thu, 11 Jul 2024 09:18:09 GMT

GET
H2 200 ping.min.js Show response
cdn.pdst.fm/ 22 KB
22 KB 99ms
26ms Script
text/javascript 35.244.142.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pdst.fm/ping.min.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 80.142.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 42e2dd427dd9f9d45367c880c68289114b7de56373ff8bdc664ea0fa3ce77880

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 20:59:33 GMT
age: 3210
x-guploader-uploadid: ACJd0NoIQnOfhRfuyzyQMBqBtDOF-9sGwaF6WRMxzG32Ou40mIDNtBUAu0QuK67GLOjOXyLrPX5TBmrFdA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22096
last-modified: Tue, 25 Jun 2024 13:55:49 GMT
server: UploadServer
etag: "4eddeec95afda969b3d1b2fb970c1eb1"
x-goog-generation: 1719323749654301
x-goog-hash: crc32c=NZyeaA==, md5=Tt3uyVr9qWmz0bL7lwwesQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 22096
accept-ranges: bytes
content-type: text/javascript
expires: Wed, 10 Jul 2024 21:59:33 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ 50 KB
21 KB 147ms
75ms Script
application/javascript 3.163.245.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.245.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: fcc3c439edc63318783aed993f9d2a5be255270297b5453bceb2384d9993886c

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
content-encoding: gzip
via: 1.1 72620161c44640062c801bfda3ae46f2.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: YUL62-P2
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 21453
x-amz-cf-id: M3DoMCKtIIW8o0fI8UwRsDzJIQWgChe7W-0wJJ58HxB_G13BImuF5g==

GET
H2 200 pptm.js Show response
www.paypal.com/tagmanager/ 16 KB
7 KB 176ms
29ms Script
application/x-javascript 151.101.65.21
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypal.com/tagmanager/pptm.js?t=xo&id=norton.com

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.21 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

947cac6d01ac6707960090bc57663b3e497c5afb3dd592c85027b036648262bf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; script-src 'nonce-SLkW5rDwaoLZsA4Q2v1ajcXe7qQ+cJdIkZFLCITHNNfeHnPF' 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://.paypalobjects.com https://.paypal.com; connect-src 'self' https://.paypal.com https://.paypalobjects.com https://.google-analytics.com 'unsafe-inline' https://.qualtrics.com; form-action 'self' https://.paypal.com; base-uri 'self' https://.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://.paypal.com https://.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; script-src 'nonce-SLkW5rDwaoLZsA4Q2v1ajcXe7qQ+cJdIkZFLCITHNNfeHnPF' 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; img-src * data:; object-src 'none'; font-src 'self' https://*.paypalobjects.com https://*.paypal.com; connect-src 'self' https://*.paypal.com https://*.paypalobjects.com https://*.google-analytics.com 'unsafe-inline' https://*.qualtrics.com; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; upgrade-insecure-requests;; report-uri https://www.paypal.com/csplog/api/log/csp; frame-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline' https://*.qualtrics.com;
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 10 Jul 2024 21:53:03 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
age: 128175
x-cache: HIT, HIT, MISS
paypal-debug-id: f294330a7df3a
server-timing: content-encoding;desc="gzip",x-cdn;desc="fastly"
dc: ccg11-origin-www-1.paypal.com
content-length: 5110
x-xss-protection: 1; mode=block
x-served-by: cache-bur-kbur8200158-BUR, cache-yyz4560-YYZ, cache-yyz4560-YYZ
accept-ch: sec-ch-ua-full, sec-ch-ua-arch, sec-ch-ua-model, sec-ch-ua-platform-version, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-bitness, sec-ch-ua-wow64
traceparent: 00-0000000000000000000f294330a7df3a-6f9a1287820faf13-01
x-timer: S1720648384.917137,VS0,VE4
etag: W/"3e48-0z7P9yTxENcGGLjvWM/jOPfsg/s"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=3600
origin-trial: AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
permissions-policy: ch-ua-platform-version=(self "https://c.paypal.com"),ch-ua-arch=(self "https://c.paypal.com"),ch-ua-wow64=(self "https://c.paypal.com"),ch-ua-model=(self "https://c.paypal.com"),ch-ua-bitness=(self "https://c.paypal.com"),ch-ua-full-version=(self "https://c.paypal.com"),ch-ua-full-version-list=(self "https://c.paypal.com")
accept-ranges: bytes
x-cache-hits: 1006, 2, 0

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 42 KB
13 KB 129ms
25ms Script
application/javascript 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 6755508f95a14ac65d6d5123ce9db08f5b0fc2921dd713a6ae8d6369a0020da9

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 20 Jun 2024 19:23:03 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "71b328aff914ada8b774bfa8fff542c4"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 12116

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 38 KB
14 KB 163ms
39ms Script
application/javascript 23.200.3.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.3.68 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

942a9ba1fe78b402e8b52b83058dbbabde8db6b4d1debf960d6d5afe5192db52

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 18 Jun 2024 16:47:26 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=68861
accept-ranges: bytes
content-length: 14004

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 19 KB
7 KB 208ms
39ms Script
application/javascript 69.147.65.252
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.65.252 , United States, ASN10310 (YAHOO-1, US),

Reverse DNS

e2-bmr.ycpi.cha.yahoo.com

Software

ATS /

Resource Hash

6784f9ac4ae19ed8651c632b214f40cac44abd344870ddd30ff1b93b08ba3103

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1, 1
date: Wed, 10 Jul 2024 21:21:35 GMT
x-amz-version-id: VxrPrcbofk65n9ysSCXrclM5xFIYS2A5
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: 3G0GD4JPR579MEMK
age: 1890
x-amz-server-side-encryption: AES256
content-length: 6672
x-amz-id-2: GXUnW48gxHGv1/VVjLcRI3lwrjxqDHMBYy8SjNsfhC3qyNE0FvqPdmikyhJMNzgJjocSiujf7ws=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 15 Aug 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 10 Jul 2024 13:59:59 GMT
server: ATS
etag: "b4dc8f0803272db7e9c028b882573ba1-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 5 KB
3 KB 303ms
90ms Script
application/javascript 23.53.35.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C4JSARJR2Q3OG0JAETF0&lib=ttq
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.35.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-35-134.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e1c9fb58d2b35b616b9566e036ab81b77d29c89a383421b09cbbc623d1a016c8

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-akamai-request-id: ddb60318.22d1f5fd
date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-24071021530443165F00492E251369D7-554B40E244BAA19E-00
x-cache: TCP_MISS from a23-52-15-70.deploy.akamaitechnologies.com (AkamaiGHost/11.5.4-57255204) (-)
x-parent-response-time: 21,23.52.15.70
server-timing: cdn-cache; desc=MISS, edge; dur=13, origin; dur=9, inner; dur=5
content-length: 2006
pragma: no-cache
server: nginx
x-tt-logid: 2024071021530443165F00492E251369D7
x-cache-remote: TCP_MISS from a23-218-222-74.deploy.akamaitechnologies.com (AkamaiGHost/11.5.3-56943929) (-)
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 10,23.218.222.74
x-tt-trace-host: 011638076690c7499bd9859f1e61fb4d04c9e6e1e13288740df25d808a0a826a0d04cbcfef083b2a50a7340c1c2205283c5c160b8fea51cc3789a5fae514b763be01d7147c6243dfb75976cd2b33835281d1c9564765f2fbcecca7942d6303f2b7e1f602cc6e6bdc2f00980acdc3953533
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H2 200 i.js Show response
tag.wknd.ai/2004/ 65 KB
15 KB 150ms
25ms Script
text/plain 34.120.253.250
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.wknd.ai/2004/i.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: 356bca7652eed28eb88bc45863aa130c2e85842f6d4bd9ba8d8fe10f32ae28f2

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:51:45 GMT
content-encoding: gzip
x-envoy-decorator-operation: tag-router.tag-router.svc.cluster.local:80/*
via: 1.1 google
age: 79
x-envoy-upstream-service-time: 2
x-region: us-central1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15078
server: istio-envoy
etag: a54acb135ba9d6
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=60
timing-allow-origin: *
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://data.cdnbasket.net>; rel=dns-prefetch, <https://page.cdnbasket.net>; rel=dns-prefetch, <https://view.cdnbasket.net>; rel=dns-prefetch, <https://ids.cdnwidget.com>; rel=dns-prefetch, <https://u.cdnwidget.com>; rel=dns-prefetch, <https://pix.cdnwidget.com>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect, <https://pd.cdnwidget.com>; rel=preconnect

GET qevents.js
a.quora.com/ 0
0

GET
H2 200 ktag.min.js Show response
www.knotch-cdn.com/ktag/latest/ 88 KB
26 KB 270ms
88ms Script
text/javascript 99.86.229.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.knotch-cdn.com/ktag/latest/ktag.min.js?accountId=68c7d46d-4f53-496f-99ba-ec17ab2c1f6c

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.229.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-229-87.iad79.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

7f91f2e16faf038ffcf5eee0f4f38cbf427f3bd4376e25ed4c94cd4d43366188

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 17:05:50 GMT
content-encoding: gzip
via: 1.1 e4c06b6e6eb895470e2fd65bbc93b3b6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: IAD79-C3
age: 17235
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: same-origin
last-modified: Thu, 16 May 2024 14:00:26 GMT
server: AmazonS3
etag: W/"195b9d3cfd4a8f4878cf513d15a7030f"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=86400
x-amz-cf-id: uLCFDiWoKBFIJtTRek6gGJajQvofw9u_yb4HbgpD3Co4Fq4anXK_dQ==

GET
H2 200 / Show response
zn7ngvh48sidro926-gendigital.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 274ms
37ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn7ngvh48sidro926-gendigital.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_7NGVH48sIDRo926

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ffc663bb7f5c642082c2fee10ab39c9249452cb222ebc4445d917e54bcb7f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 281573
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"268f-8/AP43W1njUDA7GKJi5SCBI4rok"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 8a13c8d12ac1a208-YYZ

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 5 KB
2 KB 204ms
38ms Script
application/javascript 146.75.76.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.76.84 Chicago, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 22a7c0f21be2b8240a32adb4e3b490724a69eee63bf02e47615f6d001c0f81f6

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: br
x-cdn: fastly
etag: "ecd8d25c94266835b528fc293ee30bdf"
x-amz-server-side-encryption: AES256
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
vary: Accept-Encoding, Origin
cache-control: max-age=7200
alt-svc: h3=":443";ma=600
content-length: 1880

GET
H2 200 visitor.js Show response
app.leadsrx.com/ 16 KB
16 KB 464ms
188ms Script
application/javascript 52.11.133.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.leadsrx.com/visitor.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.11.133.204 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-11-133-204.us-west-2.compute.amazonaws.com
Software: nginx/1.20.1 /
Resource Hash: 7e8f70f86d34990e70e0b696310775bc5c4327110a78a08cebf21fc072cab1b2

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
last-modified: Wed, 10 Jul 2024 17:23:06 GMT
server: nginx/1.20.1
etag: "668ec37a-40d1"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
accept-ranges: bytes
content-length: 16593

GET
H2 200 ae8f1a90-7a0c-0139-4083-06abc14c0bc6 Show response
tag.simpli.fi/sifitag/ 0
446 B 179ms
46ms Script
application/javascript 34.86.70.109
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/ae8f1a90-7a0c-0139-4083-06abc14c0bc6
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.86.70.109 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 109.70.86.34.bc.googleusercontent.com
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:04 GMT
server: openresty
content-type: application/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
x-request-id: F-D4lsbevc1WXm-uFS1B
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 evtnc.js Show response
tag.havasedge.com/js/ 23 KB
23 KB 340ms
48ms Script
application/javascript 18.160.41.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.havasedge.com/js/evtnc.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.41.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-41-116.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9a8046ae76f3c2fa5def7d0153cdb57e8d97c88ccb913dcb4209e3a9f001a36f

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:38:34 GMT
via: 1.1 0003b3450f3f9fac44312c4622a410c2.cloudfront.net (CloudFront)
last-modified: Wed, 18 Jan 2023 23:02:12 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P1
age: 871
x-amz-server-side-encryption: AES256
etag: "bb282c181bffec3889d3030dd6e067ea"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 23382
x-amz-cf-id: Hp-gxdESKcXrz7lGzGFlFr17m5dhPUS1OHhNEVHwf1cS4k31cRD5cg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 216 KB
77 KB 61ms
60ms Script
application/javascript 142.251.111.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-8136487

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-45-46-204.deploy.static.akamaitechnologies.com

Software

Google Tag Manager /

Resource Hash

28c7c71a2e2bde2a6f89916f8b408bcc8efade625629f620898db461b0a8fbcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79224
x-xss-protection: 0
last-modified: Wed, 10 Jul 2024 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 47 KB
14 KB 261ms
58ms Script
application/javascript 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a97bc8ec679a82ec782bd76c7302c0ca394c1ad672450f86f87bee5e0ec06b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 10 Jul 2024 21:53:03 GMT
last-modified: Mon, 08 Jul 2024 16:08:41 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 60D7472D7D4A4080BC80A104F3AA8A06 Ref B: YTO01EDGE0816 Ref C: 2024-07-10T21:53:04Z
etag: "804a6d1951d1da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13828

GET
H2 200 A247452-16ea-46a1-bf3e-0d9e4518ff9c1.js Show response
d.impactradius-event.com/ 37 KB
16 KB 167ms
69ms Script
text/javascript 35.186.249.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.impactradius-event.com/A247452-16ea-46a1-bf3e-0d9e4518ff9c1.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.249.72 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 72.249.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 187bd24e7f4c07a7f3e9898f0719ed419c0f15476e4c1efb3e0241ea59e99e4a

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:51:19 GMT
content-encoding: gzip
age: 105
x-guploader-uploadid: ACJd0NrEWZYqIaAw2SVLHKZTinWzrgk2P3BJf6MpB-AF81TyhP4aWrOPfpVoGNZSKf2PlcsmvzDRQSIp3g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15415
last-modified: Fri, 22 Mar 2024 16:59:36 GMT
server: UploadServer
etag: "4388e94bd6a42fddafc214ba5376d9de"
vary: Accept-Encoding
x-goog-generation: 1711126776793689
x-goog-hash: crc32c=miJbdA==, md5=Q4jpS9akL92vwhS6U3bZ3g==
access-control-allow-origin: *
content-type: text/javascript; charset=utf-8
cache-control: public,max-age=900,s-maxage=300
x-goog-stored-content-length: 15415
accept-ranges: bytes
expires: Wed, 10 Jul 2024 21:56:19 GMT

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 12 KB
5 KB 451ms
43ms Script
application/x-javascript 13.32.182.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.182.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-182-121.iad66.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f4d1e641d47b4af1b6cb7936c59626f4dbab3933473009b447406034c34facb5

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Wed, 10 Jul 2024 07:21:37 GMT
Content-Encoding: gzip
Via: 1.1 077f711c23b8630fba0cd55c24dd3124.cloudfront.net (CloudFront)
Last-Modified: Fri, 07 Jun 2024 09:20:53 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD66-C2
Age: 52288
ETag: W/"a7eb6794e868fe870db350518165c868"
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: D2baxQlpWY2wLWaSvCgGE3wwKXbJbyQcKkDsUndyCWysB_7zgRfvPQ==

GET
H2 200 t.png
tvspix.com/ 68 B
194 B 323ms
103ms Image
image/png 54.185.179.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tvspix.com/t.png?t=1720648383759&l=tvscientific-pix-o-eb001251-d952-4b93-b92d-f7ac10d97dab&u3=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.185.179.3 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-185-179-3.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 5a75a26f4dd38fe6f26a171533626d35e2df62b7c94a74c147c49589bac9b427

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-type: image/png
pragma: no-cache
date: Wed, 10 Jul 2024 21:53:04 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 68
expires: 0

GET
H3

200

src=9309239;dc_pre=CImHg966nYcDFRHEwgQdJKcH8A;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain

https://gwmtracking.com/p/v/1/59bc0993f8708105b27e9bf1/format/img
https://ad.doubleclick.net/ddm/activity/src=9309239;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://ad.doubleclick.net/ddm/activity/src=9309239;dc_pre=CImHg966nYcDFRHEwgQdJKcH8A;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://adservice.google.com/ddm/fls/z/src=9309239;dc_pre=CImHg966nYcDFRHEwgQdJKcH8A;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

42 B
63 B

236ms
102ms

Image
image/gif

172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=9309239;dc_pre=CImHg966nYcDFRHEwgQdJKcH8A;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 10 Jul 2024 21:53:04 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"6666952967269715944"}],"aggregatable_trigger_data":[{"filters":[{"14":["8402852"]}],"key_piece":"0xf632ac82ebbb80d6","source_keys":["12","13","14","15","16","17","18","19","20","21","634822640","634822641","634822642","634822643","634923228","634923229","634923230","634923231","900045100","900045101","900045102","900045103","900119636","900119637","900119638","900119639"]},{"key_piece":"0x357074f6beb13672","not_filters":{"14":["8402852"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","634822640","634822641","634822642","634822643","634923228","634923229","634923230","634923231","900045100","900045101","900045102","900045103","900119636","900119637","900119638","900119639"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"634822640":54,"634822641":54,"634822642":54,"634822643":5297,"634923228":72,"634923229":72,"634923230":72,"634923231":7062,"900045100":50,"900045101":50,"900045102":50,"900045103":4889,"900119636":34,"900119637":34,"900119638":34,"900119639":3345},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"3545698332167085515","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"6666952967269715944","filters":[{"14":["8402852"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"6666952967269715944","filters":[{"14":["8402852"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"6666952967269715944","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"6666952967269715944","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["9309239"]}}
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: image/png
location: https://adservice.google.com/ddm/fls/z/src=9309239;dc_pre=CImHg966nYcDFRHEwgQdJKcH8A;type=invmedia;cat=norto00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 e.gif
ensighten.norton.com/error/ 0
269 B 53ms
52ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/error/e.gif?msg=Cannot%20read%20properties%20of%20null%20(reading%20%27appendChild%27)&lnn=-1&fn=&cid=21&client=symantec&publishPath=aemprod&rid=3892589&did=689637&errorName=TypeError
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
via: 1.1 ea42f57e1e0a065bc1c1c637f97d3be4.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: IAD61-P1
age: 21240
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: Scwrwp_thR5wS7ClbgkOW8o8M9YESyYS0WR0-KxZ1kfBTlum2Er19g==

GET
H2 200 TC-3086-2.gif
pt.ispot.tv/v2/ 43 B
313 B 1148ms
26ms Image
image/gif 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pt.ispot.tv/v2/TC-3086-2.gif?app=web&type=visit
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.132 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 43
expires: 0

GET
H/1.1

200
OK

c
trkn.us/pixel/
Redirect Chain

https://trkn.us/pixel/c?ppt=22243&g=norton_visits&gid=51843&ord=816507030
https://trkn.us/pixel/c?ppt=22243&g=norton_visits&gid=51843&ord=816507030&ip=149.88.16.244&cuidchk=1

42 B
721 B

34ms
33ms

Image
image/gif

23.45.46.204
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://trkn.us/pixel/c?ppt=22243&g=norton_visits&gid=51843&ord=816507030&ip=149.88.16.244&cuidchk=1

Protocol

HTTP/1.1

Server

23.45.46.204 Chicago, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 10 Jul 2024 21:53:04 GMT
X-Content-Type-Options: nosniff
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Type: image/gif
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Length: 42
Expires: Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Location: /pixel/c?ppt=22243&g=norton_visits&gid=51843&ord=816507030&ip=149.88.16.244&cuidchk=1
Date: Wed, 10 Jul 2024 21:53:04 GMT
X-Content-Type-Options: nosniff
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
642 B 325ms
71ms Image
image/gif 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ct.pinterest.com/v3/?tid=2613158642812&event=pageVisit&productName=business-owner-phishing-story
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:04 GMT
referrer-policy: origin
x-cdn: fastly
content-type: image/gif
access-control-allow-origin: *
pinterest-version: cac24a94a4695e758e25b435c5c0c6dca81d437a
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 1
alt-svc: h3=":443";ma=600
x-pinterest-rid: 3039573803756796
content-length: 35
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 sst
ensighten.norton.com/pc/symantec/ 0
308 B 54ms
54ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/pc/symantec/sst?sstVersion=1.0.0&sstData=%7B%22virtualBrowser%22%3A%7B%22page%22%3A%22https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story%22%2C%22language%22%3A%22en-US%2Cen%22%2C%22screenDepth%22%3A24%2C%22height%22%3A1200%2C%22width%22%3A1600%2C%22title%22%3A%22The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner%22%2C%22timezone%22%3A%22America%2FVancouver%22%2C%22screenHeight%22%3A1200%2C%22screenWidth%22%3A1600%7D%2C%22events%22%3A%5B%7B%22name%22%3A%22facebook_conversions_api_integration%22%2C%22data%22%3A%7B%22pixel_id%22%3A%222010787619164716%22%2C%22event_data%22%3A%7B%22event_name%22%3A%22PageView%22%2C%22data_processing_options%22%3A%5B%22LDU%22%5D%2C%22data_processing_options_country%22%3A0%2C%22data_processing_options_state%22%3A0%2C%22event_id%22%3A%2296fb7431-858f-46dc-bcf6-a38775d85e2f%22%2C%22user_data%22%3A%7B%7D%7D%7D%7D%5D%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:03 GMT
cache-control: no-cache, no-store, must-revalidate
server: nginx
x-ens-event-id: af065971-38fe-451d-8656-bb830d8e11c8
x-offsite-uuid: de974d71-7fdd-40b6-bca4-7d2ef0a075bd
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/b/ 0
106 B 43ms
43ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/b/r.rnc?n=0&c=21&i=4o5w0e&p=aemprod&s=352&d=8G57InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxLCJwdWJsaXNoUGF0aCI6ImFlbXByb2QiLCJpbnN0YW5jZUlkIjoiNG81dzBlIiwicGFja2V0IjowLCJtb2RlIjoiZW5mb3JjZVgA8Btvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IlVTIE5vcnRvbiIsImRvY3UXAPIUUmVmZXJyZXIiOiIiLCJyZXF1ZXN0cyI6W3siZGVzdGluYXTMAPAZIiwidHlwZSI6ImJpbGxpbmciLCJzdGFydCI6MTcyMDY0ODM4Mzc4NHUAwGQiOi0xLCJzb3VyYzIAAisANHR1c2YAQGFzb25lANRdLCJkYXRhUGF0dGVyEgDCbGlzdCI6W10sImlkXQDANjQ4MzgzNzg0fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:02 GMT

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/c/ 0
106 B 43ms
43ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/c/r.rnc?n=0&c=21&i=5pka4q&p=aemprod&s=428&d=9CV7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxDgDwHk5hbWUiOiJzeW1hbnRlYyIsInB1Ymxpc2hQYXRoIjoiYWVtcHJvZCIsIm1vZCoAkHdoaXRlbGlzdFEA8CNvb2tpZXMiOnsiU1lNQU5URUNfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRKMA8Q8ifSwiZHQiOjE3MjA2NDgzODM3OTEsInNldHRpbmdPAPEnbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJVUyBOb3J0b24iLCJkZWZhdWx0OwDxH1NvY2lhbCBNZWRpYSI6MSwiUGVyZm9ybWFuY2UgYW5kIEZ1bmN0aW9uYWxpdHkiALJBZHZlcnRpc2luZxAA8ARuYWx5dGljcyI6MX19LCJldmVuXQAiW3sLAEEiOiJj-wBgQ2hhbmdlHgEP0AAABfgAwEFERUQiOiIxIn1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:02 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
106 KB 53ms
52ms Script
application/javascript 142.251.111.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FG3M2ET3ED

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

xx-fbcdn-shv-02-iad3.fbcdn.net

Software

Google Tag Manager /

Resource Hash

471c868e617d0dae38aebe730383c681feff32c21efb82d353abc24fbd245a55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 108061
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 223 KB
60 KB 1133ms
44ms Script
application/x-javascript 157.240.229.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.1 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c4832b19dd5406ac0855426096610e532861e94c65819651ada45299002455de

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 10 Jul 2024 21:53:05 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58653
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=12, mss=1316, tbw=2785, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: Xs3O5IKefWk4MsVH4xSQCNvgmMx9QtY6Nc8BaxBmwspvn4VHtDpxstez5wvgJQS2WJaXUZJVJ8Id3/F0kjHPeg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 nlok.ico
us.norton.com/content/dam/norton/cb/ 4 KB
5 KB 84ms
84ms Other
image/x-icon 23.202.152.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://us.norton.com/content/dam/norton/cb/nlok.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.202.152.165 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-202-152-165.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ccd7e9557cd9db88268e80255b101f1f48d4d150dbcf036b661aa99099f43500

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://us.norton.com/blog/online-scams/business-owner-phishing-story
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff, nosniff
date: Wed, 10 Jul 2024 21:53:03 GMT
content-disposition: attachment
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1720648383841_389072999_1816695585_3197_4303_40_0_219";dur=1
content-length: 4176
x-xss-protection: 1; mode=block
last-modified: Wed, 29 May 2024 21:21:42 GMT
server: Apache
etag: "1039-6199e56336580"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/x-icon
cache-control: max-age=30906194
accept-ranges: bytes
expires: Thu, 03 Jul 2025 14:56:17 GMT

POST
H2 204 / Show response
68794912.akstat.io/ 0
224 B 281ms
195ms XHR
image/gif 23.220.132.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://68794912.akstat.io/

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.132.139 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-132-139.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:04 GMT
content-type: image/gif
access-control-allow-origin: https://us.norton.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=93600
x-xss-protection: 0
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H2 200 config Show response
pixel-config.reddit.com/pixels/t2_cxz0s4qa/ 3 B
124 B 111ms
25ms XHR
application/json 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-config.reddit.com/pixels/t2_cxz0s4qa/config
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
via: 1.1 varnish
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
content-length: 27

GET
H2 200 t2_cxz0s4qa_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
699 B 82ms
33ms XHR
application/json 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_cxz0s4qa_telemetry
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 45da241a91c843b268ada7481cdece1aa679f2720931effea28d83e1398d66a9

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
server: snooserv
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
content-length: 97

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 3175ms
47ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1720648383932&id=t2_cxz0s4qa&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=ac1cec83-75ca-4cdd-b55e-b71434719584&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_e9773deb&dpm=&dpcc=&dprc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:07 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 08bef49b-4b6f-474e-958b-5a0be7a0227e.json Show response
tr.snapchat.com/config/com/ 116 B
413 B 258ms
129ms Fetch
application/json 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/config/com/08bef49b-4b6f-474e-958b-5a0be7a0227e.json?v=3.21.1-2407011851

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

API Gateway /

Resource Hash

1c861c26773390863ae121a67ec84609a45d31dc45c36c13cca0f456b92f53c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

accept: application/json
Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
observe-browsing-topics: ?1
content-type: application/json
access-control-allow-origin: https://us.norton.com
x-envoy-upstream-service-time: 46
access-control-allow-credentials: true
alt-svc: clear, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 116

GET
H2 200 i
tr.snapchat.com/cm/ Frame 31B7 0
0 209ms
85ms Document
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=08bef49b-4b6f-474e-958b-5a0be7a0227e&u_scsid=717eb1e1-f33c-4179-bab5-5ef91ae28dac&u_sclid=0aa3af28-ffa4-4f98-9a8e-72c19d003202

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-72-185-137.deploy.static.akamaitechnologies.com

Software

API Gateway /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 672
content-type: text/html
date: Wed, 10 Jul 2024 21:53:04 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
x-envoy-upstream-service-time: 0

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
764 B 205ms
119ms XHR
application/json 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=2504060&time=1720648383966&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: *
Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 18B6F36F8E354F9E9650974C2C214C3B Ref B: YTO01EDGE0507 Ref C: 2024-07-10T21:53:04Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-lor1
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-li-uuid: AAYc66u3sfgVE3N31O34Gg==
x-fs-uuid: 00061cebabb7b1f815137377d4edf81a

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2504060&time=1720648383966&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2504060&time=1720648383966&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2504060%26time%3D1720648383966%26url%3Dhttps%253A%252F%252Fus.norton.com%252Fblog...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2504060&time=1720648383966&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&cookiesTest=true&liSync=true

0
163 B

66ms
65ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2504060&time=1720648383966&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&cookiesTest=true&liSync=true
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:07 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: B8CE2BF9C2944E3482EF5B5926B87F85 Ref B: YTO01EDGE0809 Ref C: 2024-07-10T21:53:07Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYc66vxVu2+2Miy4i9osQ==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
date: Wed, 10 Jul 2024 21:53:07 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAYc66vwNodAvy47uvORFg==
pragma: no-cache
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 30E48C16952447FD9948CD11DF92462F Ref B: YTO01EDGE0809 Ref C: 2024-07-10T21:53:07Z
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2504060&time=1720648383966&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK unifiedPixel
tr.outbrain.com/ 53 B
513 B 39ms
39ms Ping
image/gif 70.42.32.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?optOut=false&bust=00802710895096499&referrer=&marketerId=001f961bd9b051a2818b4058353fda92bf&name=PAGE_VIEW&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&g=0&obApiVersion=1.1&obtpVersion=2.0.5

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

70.42.32.95 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, POST
content-type: image/gif;
access-control-allow-origin: https://us.norton.com
cache-control: no-cache
access-control-allow-credentials: true
x-traceid: 568e27fa45062c5c6c5058ebf90fd209
access-control-allow-headers: Content-Type, Authorization
content-length: 54

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 473ms
96ms Script
application/javascript 70.42.32.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=001f961bd9b051a2818b4058353fda92bf

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

70.42.32.95 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-traceid: 806dec64a068ef55be8d678f7040a76a
content-length: 39
content-type: application/javascript

GET
H/1.1 200
OK 001f961bd9b051a2818b4058353fda92bf Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
516 B 3197ms
39ms Script
text/html 23.72.185.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/001f961bd9b051a2818b4058353fda92bf

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.72.185.137 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
Date: Wed, 10 Jul 2024 21:53:07 GMT
ob-sent-time: 1720603873336
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
X-RG: NA
Cache-Control: max-age=60
X-CC: CA
Connection: keep-alive
x-traceid: b249d29c904541edb7d5a90303de0be7
Content-Length: 22
Expires: Wed, 10 Jul 2024 21:54:07 GMT

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 115ms
39ms Fetch
text/html 23.72.185.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.72.185.137 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-72-185-137.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Wed, 10 Jul 2024 21:53:04 GMT
Observe-Browsing-Topics: ?1
Content-Type: text/html
Access-Control-Allow-Origin: *
X-RG: NA
Cache-Control: max-age=1200
X-CC: CA
Connection: keep-alive
Content-Length: 26
Expires: Wed, 10 Jul 2024 22:13:04 GMT

GET
H2 200 adsct
t.co/i/ 43 B
251 B 810ms
223ms Image
image/gif 72.21.81.130
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=44f3a619-4867-4447-94b8-69fe66c1b434&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=feb3bfe7-e701-4ca6-b684-b1f6957a41e3&tw_document_href=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5fum&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.21.81.130 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-response-time: 88
date: Wed, 10 Jul 2024 21:53:04 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: d7e57e06f8d664b2
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: d00f09d6f9f91e86032e7529f8bc114023c6a4bb359c92e9e7f09a71dd932690
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
393 B 573ms
138ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=44f3a619-4867-4447-94b8-69fe66c1b434&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=feb3bfe7-e701-4ca6-b684-b1f6957a41e3&tw_document_href=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5fum&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-response-time: 6
date: Wed, 10 Jul 2024 21:53:04 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 646930f7715ac54a
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 4c52c862892dfdc648f6865bbf92b990eaca1d6b103a489a603fc96703720cb8
content-length: 43

GET
H2 200 adsct
t.co/i/ 43 B
375 B 588ms
113ms Image
image/gif 72.21.81.130
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=17c9d2ac-6599-4bbd-bdc9-f56d680bc641&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=feb3bfe7-e701-4ca6-b684-b1f6957a41e3&tw_document_href=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuzip&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.21.81.130 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-response-time: 8
date: Wed, 10 Jul 2024 21:53:04 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 70f1d5d004fc13dd
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 1531d0e587184a8a08c995665368418e3552c8e859f7781d889c1a3a3dfb7bd0
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
215 B 319ms
203ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=17c9d2ac-6599-4bbd-bdc9-f56d680bc641&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=feb3bfe7-e701-4ca6-b684-b1f6957a41e3&tw_document_href=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuzip&type=javascript&version=2.3.30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-response-time: 72
date: Wed, 10 Jul 2024 21:53:04 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 6186e5292d8daca5
cache-control: no-cache, no-store, max-age=0
perf: 7402827104
x-connection-hash: 4c52c862892dfdc648f6865bbf92b990eaca1d6b103a489a603fc96703720cb8
content-length: 43

GET
H2 200 ts
t.paypal.com/ 42 B
632 B 262ms
125ms Image
image/gif 151.101.1.35
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.paypal.com/ts?pgrp=muse%3Athird-party%3Aanalytics-xo%3A%3ADC854CZKCW2SE-1&page=muse%3Athird-party%3Aanalytics-xo%3A%3ADC854CZKCW2SE-1%3A%3A%3A&tsrce=tagmanagernodeweb&comp=tagmanagernodeweb&sub_component=analytics&s=ci&item=3acffdcb-c025-475c-ba85-3218f5e08f49&fltp=analytics&mrid=DC854CZKCW2SE&code=MUSE_ADMIN_TOOL&partner_name=MUSE_ADMIN_TOOL&flag_consume=yes&pt=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&dh=1200&dw=1600&bh=1200&bw=1600&cd=24&sh=1200&sw=1600&v=NA&pl=pdf&rosetta_language=en-US%2Cen&e=im&t=1720648383998&g=420&completeurl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&disableSetCookie=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.35 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-cache-hits: 0, 0
date: Wed, 10 Jul 2024 21:53:05 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-cache: MISS, MISS
p3p: CP="CAO IND OUR SAM UNI STA COR COM"
paypal-debug-id: ef541675a07fe
server-timing: "traceparent;desc="00-0000000000000000000ef541675a07fe-0646d6f2d218c4d0-01"";content-encoding;desc="",x-cdn;desc="fastly"
x-served-by: cache-bur-kbur8200037-BUR, cache-yyz4568-YYZ
pragma: no-cache
correlation-id: ef541675a07fe
traceparent: 00-0000000000000000000ef541675a07fe-b03091df28c70295-01
x-timer: S1720648385.164441,VS0,VE97
vary: Accept-Encoding
content-type: image/gif
access-control-expose-headers: Server-Timing
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Jul 2024 21:53:05 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 318 KB
105 KB 65ms
65ms Script
application/javascript 142.251.111.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FG3M2ET3ED&l=dataLayer&cx=c

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

093fd91dbe6a6bd1006d5e7f16d215f6823b21c444b9103e6e3a7f61ffd8976a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 107144
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H3

200

landing
googleads.g.doubleclick.net/pagead/
Redirect Chain

https://www.google.com/pagead/landing?gcs=G111&gcd=13t3t3t3t5&tag_exp=0&rnd=1956833765.1720648384&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&dma=0&npa=0&g...
https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&tag_exp=0&rnd=1956833765.1720648384&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&...

42 B
64 B

60ms
60ms

Ping
image/gif

142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&tag_exp=0&rnd=1956833765.1720648384&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&dma=0&npa=0&gtm=45be4730v9166610413za200&auid=493245650.1720648384&frm=0

Protocol

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcd=13t3t3t3t5&tag_exp=0&rnd=1956833765.1720648384&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&dma=0&npa=0&gtm=45be4730v9166610413za200&auid=493245650.1720648384&frm=0
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1069927954/ 3 KB
1 KB 147ms
63ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1069927954/?random=1720648384102&cv=11&fst=1720648384102&bg=ffffff&guid=ON&async=1&gtm=45be4730v9166610413za200&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39334a43e8f8e9eee20db7654cdc548eaeea448dcd4ac366b58eb69651c7acd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1408
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1069927954/ 3 KB
1 KB 98ms
62ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1069927954/?random=1720648384128&cv=11&fst=1720648384128&bg=ffffff&guid=ON&async=1&gtm=45be4730v9166610413za200&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&fdr=QA&data=event%3Dconversion%3Bu1%3Dhttps%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story%3Bu2%3Dblog%3Bu3%3Dbusiness-owner-phishing-story%3Bu4%3Dmissing&rfmt=3&fmt=4

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b0640eff71ff797ffa924f7d0b0aa2fe3ae145494a5be177d0e8bec95b93a601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1436
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ct Show response
bite.australiarevival.com/ 3 KB
1 KB 1229ms
82ms Script
text/javascript 50.16.211.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bite.australiarevival.com/ct?id=34870&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&sf=0&tpi=&ch=Norton&uvid=&tsf=0&tsfmi=&tsfu=&cb=1720648384172&hl=1&op=0&ag=589913651&rand=935899910210751502169917590569209411784008801550658126220621747059229112127251507098&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDQxMzZdLFsiYWJuY2giLDIxXSxbLTEzLCItIl0sWy0yMywiKyJdLFstMjUsIltcIlszMjg4OTUzMDI2LGZ1bmN0aW9uKGgpe1goZCxmdW5jdGlvbigpe2IoLTIzKShoKX0pO3JldHVybiBlLmFwcGx5KHdpbmRvdyxhcmd1bWVudHMpfV1cIixcIlwiLFwiWzQ0MDk2NTAyMSxmdW5jdGlvbiB0b1N0cmluZygpIHsgW25hdGl2ZSBjb2RlXSB9XVwiXSJdLFstMzQsIltcIlsyMzM1NzQ5MTI4LGZ1bmN0aW9uKGgpe1goZCxmdW5jdGlvbigpe2IoLTQ4KShoKX0pO3JldHVybiBnLmFwcGx5KHdpbmRvdyxhcmd1bWVudHMpfV1cIixcIlwiLFwiWzQ0MDk2NTAyMSxmdW5jdGlvbiB0b1N0cmluZygpIHsgW25hdGl2ZSBjb2RlXSB9XVwiXSJdLFstMzUsIlsxNzIwNjQ4Mzg0MDQzLDddIl0sWy0zNiwiW1wiNC8zXCIsXCI0LzNcIl0iXSxbLTUxLCItIl0sWy01MywiMTAwIl0sWy02MiwiODAiXSxbLTQsIjxodG1sIGNsYXNzPVwiZW4tVVNcIiBsYW5nPVwiZW4tVVNcIj48aGVhZCBjbGFzcz1cImF0LWVsZW1lbnQtbWFya2VyXCI%2BPHNjcmlwdCBhc3luYz1cIlwiIHNyYz1cImh0dHBzOi8vd2F2ZS5vdXRicmFpbi5jb20vbXRXYXZlc0J1bmRsZXIvaGFuZGxlci8wMDFmOTYxYmQ5YjA1MWEyODE4YjQwNTgzNTNmZGE5MmJmXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9jb25uZWN0LmZhY2Vib29rLm5ldC9lbl9VUy9mYmV2ZW50cy5qc1wiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly93d3cuZ29vZ2xldGFnbWFuYWdlci5jb20vZ3RhZy9qcz9pZD1HLUZHM00yRVQzRURcIj48L3NjcmlwdD48c3R5bGUgdHlwZT1cInRleHQvY3NzXCI%2BaHRtbC5lbi1VUyAjZW5zTm90aWZ5QmFubmVyICNlbnNCYW5uZXJEZXNjcmlwdGlvbiB7XG4gICAgdG9wOiB1bnNldDtcbn08L3N0eWxlPjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9qcy5hZHNydnIub3JnL3VwX2xvYWRlci4xLjEuMC5qc1wiPjwvc2NyaXB0PjxzY3JpcHQgYXN5bmM9XCJcIiBzcmM9XCIvL2QuaW1wYWN0cmFkaXVzLWV2ZW50LmNvbS9BMjQ3NDUyLTE2ZWEtNDZhMS1iZjNlLTBkOWU0NTE4ZmY5YzEuanNcIj48L3NjcmlwdD48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBhc3luYz1cIlwiIHNyYz1cIi8vYmF0LmJpbmcuY29tL2JhdC5qc1wiPjwvc2NyaXB0PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGFzeW5jPVwiXCIgc3JjPVwiLy93d3cuZ29vZ2xldGFnbWFuYWdlci5jb20vZ3RhZy9qcz9pZD1EQy04MTM2NDg3XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL2FwcC5sZWFkc3J4LmNvbS92aXNpdG9yLmpzXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL3MucGluaW1nLmNvbS9jdC9jb3JlLmpzXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYz1cIlwiIHNyYz1cImh0dHBzOi8vYS5xdW9yYS5jb20vcWV2ZW50cy5qc1wiPjwvc2NyaXB0PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9hbmFseXRpY3MudGlrdG9rLmNvbS9pMThuL3BpeGVsL2V2ZW50cy5qcz9zZGtpZD1DNEpTQVJKUjJRM09HMEpBRVRGMCZhbXA7bGliPXR0cVwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9zLnlpbWcuY29tL3dpL3l0Yy5qc1wiIGFzeW5jPVwiXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3d3dy5yZWRkaXRzdGF0aWMuY29tL2Fkcy9waXhlbC5qc1wiIGFzeW5jPVwiXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYz1cIlwiIHNyYz1cImh0dHBzOi8vd3d3LnBheXBhbC5jb20vdGFnbWFuYWdlci9wcHRtLmpzP3Q9eG8mYW1wO2lkPW5vcnRvbi5jb21cIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9zYy1zdGF0aWMubmV0L3NjZXZlbnQubWluLmpzXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBpZD1cInBkc3QtY2FwdHVyZVwiIGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9jZG4ucGRzdC5mbS9waW5nLm1pbi5qc1wiPjwvc2NyaXB0PjxzY3JpcHQgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL3dlYnNkay5hcHBzZmx5ZXIuY29tP3N0PWJhbm5lcnMmYW1wO1wiPjwvc2NyaXB0PjxzY3JpcHQgYXN5bmM9XCJcIiBzcmM9XCIvL2FtcGxpZnkub3V0YnJhaW4uY29tL2NwL29idHAuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJcIiBzcmM9XCIvL3d3dy5nb29nbGV0YWdtYW5hZ2VyLmNvbS9ndGFnL2pzP2lkPUFXLTEwNjk5Mjc5NTRcIj48L3NjcmlwdD48c2NyaXB0IGFzeW5jPVwiXCIgc3JjPVwiLy9zdGF0aWMuYWRzLXR3aXR0ZXIuY29tL3V3dC5qc1wiPjwvc2NyaXB0PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9jZG4ucXVhbnR1bW1ldHJpYy5jb20vcXNjcmlwdHMvcXVhbnR1bS1ub3J0b24uanNcIj48L3NjcmlwdD48cyJdLFstMTQsIi0iXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTMxLCJmYWxzZSJdLFstMzIsIi0iXSxbLTM3LCItMTQ0LTY2LTE4MC0iXSxbLTQxLCItIl0sWy00MiwiMTcyNDI5NzY1MyJdLFstNTQsIntcImhcIjpbXCJfMVwiLFwiMzI5OTkxMzY5XCIsXCJfM1wiLFwiMzI5OTkxMzY5XCJdLFwiZFwiOltcIl8xXCIsXCIyMTE1OTc2NDk2XCJdLFwiYlwiOltcIl8xXCIsXCIxNDg1MTU5NDgzXCIsXCJfMFwiLFwiNDI4OTgyODc0MlwiLFwiMTg5NjEwNTEzOFwiLFwiODE5NTk2MThcIl0sXCJzXCI6MX0iXSxbLTU3LCJXRTBaVjF4T2NWaFhYVlZjU3hjRldsWlVTVXhOWEYwSEdXSllTaGxZU1VsVlFHUVpFVnhQV0ZVWldFMFpCVmhYVmxkQVZGWk1TZ2NaRVFNT0F3Z01DUW9KQVJBVkdRVllWMVpYUUZSV1RFb0hBd2dCQXdvSkVCVllUUmw0UzB0WVFCZGZYQmtSVVUxTlNVb0RGaFpLU1ZCZFhFc1hXRXhLVFV0WVZWQllTMXhQVUU5WVZSZGFWbFFXVUJZQlhRa0JXd2hhWHdnTFd3OWRYRjFkRFE5YUR3RUpXdzVkQ0Z4YVdBQUlDQmRUU2dNSUF3OE9EQWtLRUJWWVRSbExHUkZSVFUxSlNnTVdGa3BKVUYxY1N4ZFlURXBOUzFoVlVGaExYRTlRVDFoVkYxcFdWQlpRRmdGZENRRmJDRnBmQ0F0YkQxMWNYVjBORDFvUEFRbGJEbDBJWEE9PSJdLFstNjAsMTU4XSxbLTY3LCItIl0sWy02OSwiTGludXggeDg2XzY0fEdvb2dsZSBJbmMufDh8MTZ8fDAiXSxbLTIsIjEwLGVBSFdYMS9mM3F6Q3Zia3V5bVF3Z2xJYUYzcEVzUkVFVHBvVmRGVkJRUXBSY1JCRlNLSUlnaVJJcjBLaEpScXBTQXRDQWtRSHBJenliYlhwbVpyLzUvZDk2YnpjdVNBUEovR3QiXSxbLTcsIi0iXSxbLTEyLCJudWxsIl0sWy0xOCwiWzAsMCwwLDFdIl0sWy00MywiMDAwMDAwMDEwMTAwMDAwMTAwMTExMDExMDAxMDExMDEwMDAwMDEiXSxbLTQ2LCIwIl0sWy01OCwiLSJdLFstNjQsIlswLFwiXCIsW11dIl0sWy02NiwiZ2VvbG9jYXRpb24sc3RvcmFnZWFjY2VzcyxnYW1lcGFkLGNoZWN0LG1pZGksZGlzcGxheWNhcHR1cmUsdXNiLGJyb3dzaW5ndG9waWNzLHBpY3R1cmVpbnBpY3R1cmUscHVibGlja2V5Y3JlZGVudGlhbHNnZXQsbG9jYWxmb250cyxvdHBjcmVkZW50aWFscyxlbmNyeXB0ZWRtZWRpYSxjaHNhdmVkYXRhLGNodWFmdWxsdmVyc2lvbmxpc3QsY2h1YXdvdzY0LHNoYXJlZHN0b3JhZ2UsY2hkb3dubGluayxjaHByZWZlcnNjb2xvcnNjaGVtZSxzeW5jeGhyLGNodWFtb2RlbCxjaHByZWZlcnNyZWR1Y2VkdHJhbnNwYXJlbmN5LHNlcmlhbCxjYW1lcmEsY2hwcmVmZXJzcmVkdWNlZG1vdGlvbixwcml2YXRlc3RhdGV0b2tlbmlzc3VhbmNlLGlkZW50aXR5Y3JlZGVudGlhbHNnZXQsY2h1YWZ1bGx2ZXJzaW9uLGZ1bGxzY3JlZW4sY2hkcHIsdW5sb2FkLGtleWJvYXJkbWFwLGNodWFwbGF0Zm9ybSxzaGFyZWRzdG9yYWdlc2VsZWN0dXJsLGd5cm9zY29wZSxpbnRlcmVzdGNvaG9ydCxjaHVhbW9iaWxlLHdpbmRvd21hbmFnZW1lbnQsY2h1YSxwdWJsaWNrZXljcmVkZW50aWFsc2NyZWF0ZSxtYWduZXRvbWV0ZXIsYWNjZWxlcm9tZXRlcixwcml2YXRlc3RhdGV0b2tlbnJlZGVtcHRpb24sY2h1YWFyY2gseHJzcGF0aWFsdHJhY2tpbmcsY2h1YWZvcm1mYWN0b3JzLGlkbGVkZXRlY3Rpb24sY2h1YXBsYXRmb3JtdmVyc2lvbixjaHdpZHRoLGNsaXBib2FyZHJlYWQsY2h2aWV3cG9ydHdpZHRoLGNvbXB1dGVwcmVzc3VyZSxwYXltZW50LGNodmlld3BvcnRoZWlnaHQsY2hydHQsYXV0b3BsYXksY3Jvc3NvcmlnaW5pc29sYXRlZCxoaWQsY2h1YWJpdG5lc3Msc2NyZWVud2FrZWxvY2sscHJpdmF0ZWFnZ3JlZ2F0aW9uLGNsaXBib2FyZHdyaXRlLGF0dHJpYnV0aW9ucmVwb3J0aW5nLGNoZGV2aWNlbWVtb3J5LG1pY3JvcGhvbmUiXSxbLTY4LCItIl0sWy0yNywiWzUwLDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0yOSwiLSJdLFstNjEsIntcIndnc2xcIjpcIjQ7cmVhZG9ubHlfYW5kX3JlYWR3cml0ZV9zdG9yYWdlX3RleHR1cmVzO3BhY2tlZF80eDhfaW50ZWdlcl9kb3RfcHJvZHVjdDt1bnJlc3RyaWN0ZWRfcG9pbnRlcl9wYXJhbWV0ZXJzO3BvaW50ZXJfY29tcG9zaXRlX2FjY2VzcztcIixcInBjZlwiOlwiYmdyYTh1bm9ybVwifSJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstNDcsIkFtZXJpY2EvVmFuY291dmVyLGVuLUdCLGxhdG4sZ3JlZ29yeSJdLFstNTksImRlZmF1bHQiXSxbLTYsIntcIndcIjpbXCIxXCIsXCIyXCJdLFwiblwiOltdLFwiZFwiOltdfSJdLFstMjEsIi0iXSxbLTM4LCJjLC0xLC0xLDAsMCwxNDEsMCwwLDEyMywxMzAsLTEsNDMsMTU4MS43LDE1ODEuNywyMjAwLDIyMDEiXSxbLTQ0LCIwLDAsMCw1Il0sWy05LCIrIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwidHdpdHRlcjp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiXX0iXSxbLTE1LCItIl0sWy0xOSwiWzcwLDcwLDcwLDcwLDAsMCwxLDI0LDI0LFwiLVwiLDE2MDAsMTIwMCwxNjAwLDEyMDAsMTYwMCwxMjg1LDE2MDAsMTIwMCwwLDAsMCwwLFwiLVwiLFwiLVwiLDE2MDAsMTIwMF0iXSxbLTI2LCJ7XCJ0amhzXCI6MjU5NDMxNTEsXCJ1amhzXCI6MTg1OTUzODcsXCJqaHNsXCI6NDI5NDcwNTE1Mn0iXSxbLTQ4LCIwLDAiXSxbLTYzLCIwIl0sWy0xNiwiMCJdLFstMjQsIltcInNlbmRCZWFjb25cIiwwLDEsMSwxXSJdLFstNDUsIi0iXSxbLTQ5LCItIl0sWy01NiwibGFuZHNjYXBlLXByaW1hcnkiXSxbLTY1LCItIl0sWy01LCItIl0sWy04LCItIl0sWy0zOSwiW1wiMjAwMzAxMDdcIiwyLFwiR2Vja29cIixcIk5ldHNjYXBlXCIsXCJNb3ppbGxhXCIsbnVsbCxudWxsLHRydWUsOCxmYWxzZSxudWxsLDUsdHJ1ZSx0cnVlLG51bGwsMCx0cnVlLHRydWVdIl0sWy00MCwiMzMiXSxbLTU1LCIxIl0sWzM3LCJbMzMxNjIyNDA0OSxmdW5jdGlvbihuZXdWYWx1ZSkge1xuICAgICAgICAgICAgICBhZGRDb250ZW50V2luZG93UHJveHkodGhpcylcbiAgICAgICAgICAgICAgLy8gUmVzZXQgcHJvcGVydHksIHRoZSBob29rIGlzIG9ubHkgbmVlZGVkIG9uY2VcbiAgICAgICAgICAgICAgT2JqZWN0LmRlZmluZVByb3BlcnR5KGlmcmFtZSwgJ3NyY2RvYycsIHtcbiAgICAgICAgICAgICAgICBjb25maWd1cmFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHdyaXRhYmxlOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB2YWx1ZTogX3NyY2RvY1xuICAgICAgICAgICAgICB9KVxuICAgICAgICAgICAgICBfaWZyYW1lLnNyY2RvYyA9IG5ld1ZhbHVlXG4gICAgICAgICAgICB9XSJdLFstMjAsIi0iXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy01MCwiLSJdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiaW50ZWwgaW5jLlwiLFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjksXCJ3Z2xcIjoxLFwiZ3JlblwiOlwid2Via2l0IHdlYmdsXCIsXCJzZWZcIjoxOTMwODIwMjc5LFwic2VjXCI6XCJcIn0iXSxbImJuY2giLDE2OF0sWy0xLCItIl0sWy0xMCwiLSJdLFstMTcsIjE2Il0sWy0yOCwiZW4tVVMsZW4iXSxbLTMzLCJbXCJbNTM5MzU4NDM3LGZ1bmN0aW9uKGgpe1goZCxmdW5jdGlvbigpe2IoLTQ3KShoKX0pO1xcbnJldHVybiBmLmFwcGx5KHdpbmRvdyxhcmd1bWVudHMpfV1cIixcIlwiLFwiWzQ0MDk2NTAyMSxmdW5jdGlvbiB0b1N0cmluZygpIHsgW25hdGl2ZSBjb2RlXSB9XVwiXSJdLFstNTIsIi0iXSxbImRkYiIsIjAsMTAsMCwyLDAsNiwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMSwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwxLDAsMSwwLDAsMCwwLDAsMSwwLDIsMCwwLDAsMSwxLDAsMCwwLDAsMCwwLDAsMCwxLDAsMTcsMSwwLDAsMCwwLDAsMCwwLDEiXSxbImNiIiwiMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMTEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCw1LDAsMCwwLDAsMCwwLDAsMCwwIl1d&dep=0&pre=0&sdd=%7B%7D&cri=1z00ldSt5H&pto=2227&ver=61&gac=-&mei=&ap=&fe=1&duid=1.1720648384.zSkhiYx0Pz0vTpsu&suid=1.1720648384.0NGtghPt974X1O3p&tuid=1.1720648384.6CEtcTmJYYqnDSQt&fbc=-&gtm=WyJjb252ZXJzaW9uIl0%3D&it=75%2C1812%2C203&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-211-97.compute-1.amazonaws.com
Software: /
Resource Hash: f2d066c6cf187d7f6b33b8b0d9b5960303f45ccb62ef622c6ef8eaf87e41a5bd

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-type: text/javascript
pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 1208
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p
tr.snapchat.com/ 0
252 B 131ms
80ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

e2-bmr.ycpi.cha.yahoo.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://us.norton.com
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
alt-svc: clear, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 runtime_6459738026535cda4232dc813c61447d.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 3 KB
2 KB 3422ms
28ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/runtime_6459738026535cda4232dc813c61447d.br.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 59f1b7d93f47fcc926143154888aa471910eaf81c3c41270b61cfe012dda08df

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 03 Jul 2024 20:23:18 GMT
content-encoding: br
age: 610190
x-guploader-uploadid: ACJd0Noj-g2EnaJ9doWBT-i1fCC9qOZTvUtIYzmN1hD99FCwnuvpBPkCAvrLz9DOsdMjeymVVV_7R6yLNw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1316
last-modified: Mon, 01 Jul 2024 15:42:03 GMT
server: UploadServer
etag: "09512239cb2a22728ca9f8608dfc2181"
x-goog-generation: 1717444369584127
ad-auction-allowed: true
access-control-allow-origin: *
x-goog-hash: crc32c=BS9gKg==, md5=CVEiOcsqInKMqfhgjfwhgQ==
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 1316
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 11548.json Show response
s.yimg.com/wi/config/ 2 B
467 B 1132ms
37ms XHR
application/json 69.147.65.252
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/11548.json

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.147.65.252 , United States, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1, 1
date: Wed, 10 Jul 2024 20:56:06 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: E03VXWYYCJ945ATA
age: 3419
content-length: 2
x-amz-id-2: PkwiNR6C89qrYqEWKCg/w1VkxJ06l2P32fD0OtQpWXLwp5uMrrbZ63oivPzZneOc8WLqO9Dst2c=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

GET
H2 200 main.ea1c939c.js Show response
s.pinimg.com/ct/lib/ 80 KB
23 KB 38ms
37ms Script
application/javascript 146.75.76.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.ea1c939c.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.76.84 Chicago, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d23d5715ffe428ffa9ce297fba04eb9ba463cbc6478269f0c53ceeeada3c95c6

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: br
x-cdn: fastly
etag: "2bb7f81e0335844a4b164b873a7f7a30"
x-amz-server-side-encryption: AES256
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
vary: Accept-Encoding, Origin
cache-control: max-age=1209600
alt-svc: h3=":443";ma=600
content-length: 23139

GET
H2 200 main.MWU2NDEzYzJiMQ.js Show response
analytics.tiktok.com/i18n/pixel/static/ 344 KB
99 KB 49ms
48ms Script
application/javascript 23.53.35.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWU2NDEzYzJiMQ.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.35.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-35-134.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8b5eaf40218075cea5deeb7f5b1f281030c970a307707acb1a2057518c64a902

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-akamai-request-id: 22d1fce2
date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 20240702114422D1993E87B2A9AB478A72
x-tt-trace-id: 00-240702114422D1993E87B2A9AB478A72-3D4734D58F62F54B-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-52-15-70.deploy.akamaitechnologies.com (AkamaiGHost/11.5.4-57255204) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 01f2cd1f6f6ae2b777757fab7cd05d142433457ac515b4b180a564e180d8e5680bdbe68649679ce94c13c721f0613af4c6769a571c2fb5e083e894cb4551a1bb88b8861497b38ce34ffe26ad272ced55703f947b5fe5115df954471b81f9b6ac3c
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=17
content-length: 100269

GET
H2 200 12.f83656fbc6c9f02061b2.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 74 KB
21 KB 38ms
34ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.f83656fbc6c9f02061b2.chunk.js?Q_CLIENTVERSION=2.10.0&Q_CLIENTTYPE=web&Q_BRANDID=us.norton.com

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

369a904e6a2a6cb6fef3e935c723dead810c01aa74ff7771983a06e5f3cf8f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 78322
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 01 Jul 2024 18:09:29 GMT
server: cloudflare
etag: W/"12863-1906f7ccfa8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 8a13c8d7c8a1a208-YYZ

GET
H2

200

activityi;dc_pre=CPb3yd66nYcDFUnGwgQdr3sK4w;src=8136487;type=lp;cat=blogp0;ord=8591380388855;npa=0;auiddc=493245650.1720648384;u10=unknown;u14=direct;u16=undefined;ps=1;pcor=738981291;uaa=;uab=;uaf...
8136487.fls.doubleclick.net/ Frame AAAC
Redirect Chain

https://8136487.fls.doubleclick.net/activityi;src=8136487;type=lp;cat=blogp0;ord=8591380388855;npa=0;auiddc=493245650.1720648384;u10=unknown;u14=direct;u16=undefined;ps=1;pcor=738981291;uaa=;uab=;u...
https://8136487.fls.doubleclick.net/activityi;dc_pre=CPb3yd66nYcDFUnGwgQdr3sK4w;src=8136487;type=lp;cat=blogp0;ord=8591380388855;npa=0;auiddc=493245650.1720648384;u10=unknown;u14=direct;u16=undefin...

0
0

112ms
112ms

Document
text/html

142.251.111.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8136487.fls.doubleclick.net/activityi;dc_pre=CPb3yd66nYcDFUnGwgQdr3sK4w;src=8136487;type=lp;cat=blogp0;ord=8591380388855;npa=0;auiddc=493245650.1720648384;u10=unknown;u14=direct;u16=undefined;ps=1;pcor=738981291;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4730v9170891986za200;gcs=G111;gcd=13t3t3t3t5;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story?

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 377
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 10 Jul 2024 21:53:05 GMT
expires: Wed, 10 Jul 2024 21:53:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 10 Jul 2024 21:53:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8136487.fls.doubleclick.net/activityi;dc_pre=CPb3yd66nYcDFUnGwgQdr3sK4w;src=8136487;type=lp;cat=blogp0;ord=8591380388855;npa=0;auiddc=493245650.1720648384;u10=unknown;u14=direct;u16=undefined;ps=1;pcor=738981291;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4730v9170891986za200;gcs=G111;gcd=13t3t3t3t5;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

activityi;dc_pre=CNr5yd66nYcDFfAarQYdSLkELA;src=8136487;type=lp;cat=unive0;ord=1;num=190752282375;npa=0;auiddc=493245650.1720648384;u10=unknown;u11=missing;u14=direct;u16=undefined;u3=undefined;u9=...
8136487.fls.doubleclick.net/ Frame B4E4
Redirect Chain

https://8136487.fls.doubleclick.net/activityi;src=8136487;type=lp;cat=unive0;ord=1;num=190752282375;npa=0;auiddc=493245650.1720648384;u10=unknown;u11=missing;u14=direct;u16=undefined;u3=undefined;u...
https://8136487.fls.doubleclick.net/activityi;dc_pre=CNr5yd66nYcDFfAarQYdSLkELA;src=8136487;type=lp;cat=unive0;ord=1;num=190752282375;npa=0;auiddc=493245650.1720648384;u10=unknown;u11=missing;u14=d...

0
0

147ms
145ms

Document
text/html

142.251.111.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8136487.fls.doubleclick.net/activityi;dc_pre=CNr5yd66nYcDFfAarQYdSLkELA;src=8136487;type=lp;cat=unive0;ord=1;num=190752282375;npa=0;auiddc=493245650.1720648384;u10=unknown;u11=missing;u14=direct;u16=undefined;u3=undefined;u9=undefined;ps=1;pcor=1469740021;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4730v9170891986za200;gcs=G111;gcd=13t3t3t3t5;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story?

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f149.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 403
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 10 Jul 2024 21:53:05 GMT
expires: Wed, 10 Jul 2024 21:53:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 10 Jul 2024 21:53:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8136487.fls.doubleclick.net/activityi;dc_pre=CNr5yd66nYcDFfAarQYdSLkELA;src=8136487;type=lp;cat=unive0;ord=1;num=190752282375;npa=0;auiddc=493245650.1720648384;u10=unknown;u11=missing;u14=direct;u16=undefined;u3=undefined;u9=undefined;ps=1;pcor=1469740021;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4730v9170891986za200;gcs=G111;gcd=13t3t3t3t5;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 240 KB
85 KB 52ms
52ms Script
application/javascript 142.251.111.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1043330685&l=dataLayer&cx=c

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

124505945b4e39a7d0bd5001aeb4431b96f3e23af8f3bc9434b4570ab3ca93c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87180
x-xss-protection: 0
last-modified: Wed, 10 Jul 2024 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H3 200 activity;register_conversion=1;src=8136487;type=lp;cat=blogp0;ord=8591380388855;npa=0;auiddc=493245650.1720648384;u10=unknown;u14=direct;u16=undefined;ps=1;pcor=738981291;uaa=;uab=;uafvl=;uamb=0;ua...
ad.doubleclick.net/ 0
22 B 103ms
102ms Image
image/png 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=8136487;type=lp;cat=blogp0;ord=8591380388855;npa=0;auiddc=493245650.1720648384;u10=unknown;u14=direct;u16=undefined;ps=1;pcor=738981291;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4730v9170891986za200;gcs=G111;gcd=13t3t3t3t5;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f149.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"16625474983652701229"}],"aggregatable_trigger_data":[{"filters":[{"14":["14079757"]}],"key_piece":"0x201542446ebc0b18","source_keys":["12","13","14","15","16","17","18","19","20","21","15112496","15112497","15112498","15112499","15701148","15701149","15701150","15701151","628773044","628773045","628773046","628773047","634844724","634844725","634844726","634844727","634859536","634859537","634859538","634859539","634873080","634873081","634873082","634873083","634961444","634961445","634961446","634961447","900072496","900072497","900072498","900072499","900082644","900082645","900082646","900082647","900148224","900148225","900148226","900148227"]},{"key_piece":"0x7b5d864fe856ea62","not_filters":{"14":["14079757"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","15112496","15112497","15112498","15112499","15701148","15701149","15701150","15701151","628773044","628773045","628773046","628773047","634844724","634844725","634844726","634844727","634859536","634859537","634859538","634859539","634873080","634873081","634873082","634873083","634961444","634961445","634961446","634961447","900072496","900072497","900072498","900072499","900082644","900082645","900082646","900082647","900148224","900148225","900148226","900148227"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"15112496":38,"15112497":38,"15112498":38,"15112499":3739,"15701148":43,"15701149":43,"15701150":43,"15701151":4237,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"628773044":54,"628773045":54,"628773046":54,"628773047":5297,"634844724":40,"634844725":40,"634844726":40,"634844727":3973,"634859536":34,"634859537":34,"634859538":34,"634859539":3345,"634873080":46,"634873081":46,"634873082":46,"634873083":4540,"634961444":46,"634961445":46,"634961446":46,"634961447":4540,"900072496":54,"900072497":54,"900072498":54,"900072499":5297,"900082644":43,"900082645":43,"900082646":43,"900082647":4237,"900148224":43,"900148225":43,"900148226":43,"900148227":4237},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"4901261025983579594","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"16625474983652701229","filters":[{"14":["14079757"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"16625474983652701229","filters":[{"14":["14079757"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"16625474983652701229","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"16625474983652701229","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["8136487"]}}
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activity;register_conversion=1;src=8136487;type=lp;cat=unive0;ord=1;num=190752282375;npa=0;auiddc=493245650.1720648384;u10=unknown;u11=missing;u14=direct;u16=undefined;u3=undefined;u9=undefined;ps=...
ad.doubleclick.net/ 0
22 B 101ms
100ms Image
image/png 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=8136487;type=lp;cat=unive0;ord=1;num=190752282375;npa=0;auiddc=493245650.1720648384;u10=unknown;u11=missing;u14=direct;u16=undefined;u3=undefined;u9=undefined;ps=1;pcor=1469740021;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4730v9170891986za200;gcs=G111;gcd=13t3t3t3t5;dma=0;tag_exp=0;epver=2;~oref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f149.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"15246072818442176259"}],"aggregatable_trigger_data":[{"filters":[{"14":["14085484"]}],"key_piece":"0xa83a5c0c67e67249","source_keys":["12","13","14","15","16","17","18","19","20","21","15112496","15112497","15112498","15112499","15701148","15701149","15701150","15701151","628773044","628773045","628773046","628773047","634844724","634844725","634844726","634844727","634859536","634859537","634859538","634859539","634873080","634873081","634873082","634873083","634961444","634961445","634961446","634961447","900072496","900072497","900072498","900072499","900082644","900082645","900082646","900082647","900148224","900148225","900148226","900148227"]},{"key_piece":"0xd7a1c11f05854439","not_filters":{"14":["14085484"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","15112496","15112497","15112498","15112499","15701148","15701149","15701150","15701151","628773044","628773045","628773046","628773047","634844724","634844725","634844726","634844727","634859536","634859537","634859538","634859539","634873080","634873081","634873082","634873083","634961444","634961445","634961446","634961447","900072496","900072497","900072498","900072499","900082644","900082645","900082646","900082647","900148224","900148225","900148226","900148227"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"15112496":38,"15112497":38,"15112498":38,"15112499":3739,"15701148":43,"15701149":43,"15701150":43,"15701151":4237,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"628773044":54,"628773045":54,"628773046":54,"628773047":5297,"634844724":40,"634844725":40,"634844726":40,"634844727":3973,"634859536":34,"634859537":34,"634859538":34,"634859539":3345,"634873080":46,"634873081":46,"634873082":46,"634873083":4540,"634961444":46,"634961445":46,"634961446":46,"634961447":4540,"900072496":54,"900072497":54,"900072498":54,"900072499":5297,"900082644":43,"900082645":43,"900082646":43,"900082647":4237,"900148224":43,"900148225":43,"900148226":43,"900148227":4237},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"15867086304229668746","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"15246072818442176259","filters":[{"14":["14085484"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"15246072818442176259","filters":[{"14":["14085484"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"15246072818442176259","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"15246072818442176259","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["8136487"]}}
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p
tr6.snapchat.com/ 0
46 B 153ms
113ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr6.snapchat.com/p

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 10 Jul 2024 21:53:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 26
via: 1.1 google, 1.1 google
server: API Gateway
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 4405 Show response
norton.ow5a.net/xur/ 119 B
1003 B 3313ms
87ms XHR
application/json 44.199.80.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://norton.ow5a.net/xur/4405
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.199.80.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-199-80-114.compute-1.amazonaws.com
Software: /
Resource Hash: 28b4b43b294f0c458b834b02440e46d45a3d93e39014085e513695a3d521daea

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:07 GMT
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
access-control-allow-origin: https://us.norton.com
content-type: application/json; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 10 Jul 2024 21:53:07 GMT

GET
H2 204 5441611.js Show response
bat.bing.com/p/action/ 0
117 B 54ms
54ms Script
text/plain 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5441611.js

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Wed, 10 Jul 2024 21:53:03 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 09C60C990B9942A2A39C1A95383C1DF8 Ref B: YTO01EDGE0816 Ref C: 2024-07-10T21:53:04Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
361 B 87ms
86ms Image
text/plain 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5441611&Ver=2&mid=eb7351e2-b504-43d3-8a72-f4d5e104a4b4&sid=c8df2a903f0611efa4c5cf175aca2d0e&vid=c8df36903f0611efa13a21011c68e9c8&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&p=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&r=&lt=1846&evt=pageLoad&sv=1&cdb=AQAA&rn=610847

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 10 Jul 2024 21:53:03 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B0F9DD6E00F6438BB20A616BE14C95ED Ref B: YTO01EDGE0816 Ref C: 2024-07-10T21:53:04Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect Show response
analytics.google.com/g/ 0
252 B 3200ms
71ms Fetch
text/plain 216.239.36.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-FG3M2ET3ED&gtm=45je4730v880748444za200zb9166610413&_p=1720648383755&_gaz=1&gcs=G111&gcd=13t3t3t3t5&npa=0&dma=0&tag_exp=0&cid=1217099466.1720648384&ecid=123205397&ul=en-ca&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1720648384&sct=1&seg=0&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&dt=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2530&_z=fetch
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://us.norton.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
252 B 1148ms
53ms Ping
text/plain 142.251.179.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-FG3M2ET3ED&cid=1217099466.1720648384&gtm=45je4730v880748444za200zb9166610413&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.179.155 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: pd-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://us.norton.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 161ms
102ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-FG3M2ET3ED&cid=1217099466.1720648384&gtm=45je4730v880748444za200zb9166610413&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t5&npa=0&frm=0&z=358802357

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-11-133-204.us-west-2.compute.amazonaws.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
cookie.havasedge.com/
Redirect Chain

https://event.havasedge.com/track-event?emeta=eyJwIjoiaHR0cHM6Ly91cy5ub3J0b24uY29tL2Jsb2cvb25saW5lLXNjYW1zL2J1c2luZXNzLW93bmVyLXBoaXNoaW5nLXN0b3J5IiwibyI6Imh0dHBzOi8vdXMubm9ydG9uLmNvbSIsImFvIjpbXSw...
https://cookie.havasedge.com/sync?trkGuid=0d24d362-9133-4cf0-8e7e-be8762f0510a

35 B
534 B

516ms
97ms

Image
image/gif

44.239.239.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cookie.havasedge.com/sync?trkGuid=0d24d362-9133-4cf0-8e7e-be8762f0510a
Protocol: H2
Server: 44.239.239.36 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-239-36.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
date: Wed, 10 Jul 2024 21:53:06 GMT
content-length: 35
content-type: image/gif

Redirect headers

location: https://cookie.havasedge.com/sync?trkGuid=0d24d362-9133-4cf0-8e7e-be8762f0510a
date: Wed, 10 Jul 2024 21:53:05 GMT
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 327 B
416 B 62ms
61ms XHR
application/json 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/user/?tid=2613158642812&pd=%7B%22np%22%3A%22ensighten%22%7D&cb=1720648384524&dep=2%2CPAGE_LOAD
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5612e07185add6333ccf39345089eedafce9235ae2770f3e3c93e88805532780

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
x-cdn: fastly
x-envoy-upstream-service-time: 0
alt-svc: h3=":443";ma=600
x-pinterest-rid: 1458866224492173
content-length: 187
pin-unauth: dWlkPU5Ea3laRGM1WkRBdE1ETXhNQzAwTXpReExXRTVOamt0TVRBME5EVm1OemhpTmpjeg
pragma: no-cache
referrer-policy: origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://us.norton.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: cac24a94a4695e758e25b435c5c0c6dca81d437a
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 identify_ce1d8843.js Show response
analytics.tiktok.com/i18n/pixel/static/ 146 KB
39 KB 45ms
45ms Script
application/javascript 23.53.35.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/identify_ce1d8843.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.35.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-35-134.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: d891e16dbaf81b89f017b6516afdeffe602f8df1d5e269429e7b6eaf63726a03

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-akamai-request-id: 22d2030a
date: Wed, 10 Jul 2024 21:53:04 GMT
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server: nginx
x-tt-logid: 20240521142943A7B829C3D511734C3A5F
x-tt-trace-id: 00-240521142943A7B829C3D511734C3A5F-360824E02D69F85F-00
vary: Accept-Encoding
x-cache: TCP_MEM_HIT from a23-52-15-70.deploy.akamaitechnologies.com (AkamaiGHost/11.5.4-57255204) (-)
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
x-tt-trace-host: 01b0fcdf97f3e0c0654cda8905ca7e4486ec04a74fcfd11b80bd514721fa65309383c9048b0c0551eb9f72b0b73e2f76bfd1edb3dafdf62af247abdcc03110148358ba5fa3c2f3074ff720d9cff393d82cdde1d2c776a4212a387d20b73275bd0e
server-timing: cdn-cache; desc=HIT, edge; dur=1, origin; dur=0, inner; dur=3
content-length: 39510

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
840 B 85ms
85ms Ping
text/plain 23.53.35.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.35.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-35-134.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 1c0fce11.22d20374
date: Wed, 10 Jul 2024 21:53:04 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240710215304FB0F688A9E27BE131D74-67188C098D3A3866-00
x-cache: TCP_MISS from a23-52-15-70.deploy.akamaitechnologies.com (AkamaiGHost/11.5.4-57255204) (-)
x-parent-response-time: 37,23.52.15.70
server-timing: cdn-cache; desc=MISS, edge; dur=10, origin; dur=33, inner; dur=30
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20240710215304FB0F688A9E27BE131D74
x-cache-remote: TCP_MISS from a23-218-222-68.deploy.akamaitechnologies.com (AkamaiGHost/11.5.4-57255204) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 34,23.218.222.68
x-tt-trace-host: 011638076690c7499bd9859f1e61fb4d04c9e6e1e13288740df25d808a0a826a0d823a56e23cd468f55447b48fe232ff88ed962be8174262b27dc93a82d5461228bca2aae7e7ce8c54c0d93e62c8cb6f3a0ae713536d2e0b5c1b7b806b31de516cbd7b0b83177ef8219be65a702f0c9479
access-control-allow-headers: Authorization,*
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H2 200 visitor.php Show response
app.leadsrx.com/ 103 B
534 B 167ms
166ms XHR
text/html 52.11.133.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.leadsrx.com/visitor.php?acctTag=csiyrk42502&tz=420&ref=&u=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&t=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&lc=null&anon=0&vin=null

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

52.11.133.204 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx/1.20.1 / PHP/5.6.40

Resource Hash

6fde933aeaad4ec162fe8154794b81fa4ea23e0065e70a137b34bcca18479570

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
x-content-type-options: nosniff
server: nginx/1.20.1
x-powered-by: PHP/5.6.40
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
access-control-allow-origin: https://us.norton.com
access-control-allow-credentials: true

GET
H2 200 / Show response
ct.pinterest.com/v3/ 35 B
120 B 51ms
50ms Fetch
image/gif 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/v3/?tid=2613158642812&pd=%7B%22np%22%3A%22ensighten%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%22ea1c939c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1720648384577
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:04 GMT
referrer-policy: origin
x-cdn: fastly
content-type: image/gif
access-control-allow-origin: https://us.norton.com
pinterest-version: 98a5c1f9a97216ab594bea30094df12248eb1060
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
alt-svc: h3=":443";ma=600
x-pinterest-rid: 3091005769815677
content-length: 35
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 p
tr.snapchat.com/ 0
48 B 87ms
85ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://us.norton.com
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/1043330685/ 3 KB
2 KB 113ms
61ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1043330685/?random=1720648384615&cv=11&fst=1720648384615&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&label=sale&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&gtm_ee=1&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dbusiness-owner-phishing-story%3Becomm_traffic_source%3Ddirect&rfmt=3&fmt=4

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

248843598d6ed55391c9fa1c8b48cc3d09f28224dfef780ab19da2734ed664d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1612
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/ 3 KB
1 KB 62ms
61ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?random=1720648384629&cv=11&fst=1720648384629&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73c5f9cc7f00ee3f98f1c34fd15568da02a29a437834fd42a87243337d3a8b72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1442
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 token_create.js Show response
ct.pinterest.com/static/ct/ 4 KB
4 KB 27ms
27ms Script
application/javascript 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/static/ct/token_create.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_256_GCM
Server: 151.101.0.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cd56592299c1c670fb97ef28bcb50048508c01879ecb23b71364aecc0483e202

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:04 GMT
x-cdn: fastly
age: 1172
etag: "19c94b308deaf8fbf050b4fca2fa21b7"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=7200
timing-allow-origin: https://ct.pinterest.com
alt-svc: h3=":443";ma=600
content-length: 4103

GET
H2 200 ct.html
ct.pinterest.com/ Frame 2507 0
0 439ms
46ms Document
text/html 151.101.192.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/ct.html
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.192.84 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://us.norton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443";ma=600
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Wed, 10 Jul 2024 21:53:05 GMT
pinterest-version: 98a5c1f9a97216ab594bea30094df12248eb1060
referrer-policy: origin
x-cdn: fastly
x-envoy-upstream-service-time: 0
x-pinterest-rid: 8406706701198959

GET
H2

200

/
match.adsrvr.org/track/upb/ Frame 496D
Redirect Chain

https://insight.adsrvr.org/track/up?adv=9e5b3bs&ref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&upid=jirrmzm&upv=1.1.0
https://match.adsrvr.org/track/upb/?adv=9e5b3bs&ref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&upid=jirrmzm&upv=1.1.0

0
0

54ms
46ms

Document
text/html

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/upb/?adv=9e5b3bs&ref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&upid=jirrmzm&upv=1.1.0
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://us.norton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 10 Jul 2024 21:53:04 GMT
server: Kestrel
vary: Accept-Encoding

Redirect headers

content-length: 363
date: Wed, 10 Jul 2024 21:53:04 GMT
location: https://match.adsrvr.org/track/upb/?adv=9e5b3bs&ref=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&upid=jirrmzm&upv=1.1.0
server: Kestrel

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
840 B 148ms
146ms Ping
text/plain 23.53.35.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.35.134 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-35-134.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 1f8b21f5.22d20c5b
date: Wed, 10 Jul 2024 21:53:05 GMT
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-240710215304EF0CBAC10D93E211BE08-66DB75B54B66DE06-00
x-cache: TCP_MISS from a23-52-15-70.deploy.akamaitechnologies.com (AkamaiGHost/11.5.4-57255204) (-)
x-parent-response-time: 71,23.52.15.70
server-timing: cdn-cache; desc=MISS, edge; dur=42, origin; dur=63, inner; dur=55
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20240710215304EF0CBAC10D93E211BE08
x-cache-remote: TCP_MISS from a23-218-222-71.deploy.akamaitechnologies.com (AkamaiGHost/11.5.3-56943929) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 63,23.218.222.71
x-tt-trace-host: 011638076690c7499bd9859f1e61fb4d04c9e6e1e13288740df25d808a0a826a0de097f9f60d91f23a9716f20fa2ee014d751374a8e701f0f62aefd4e8f19d5b6460524aff76707d2325a73972a2d08c0c3b1e8c58d68eb6fad607aa21f91a3adbd7d167477bce8be2bb86467d2a900aa9
access-control-allow-headers: Authorization,*
expires: Wed, 10 Jul 2024 21:53:05 GMT

GET
H2 200 68c7d46d-4f53-496f-99ba-ec17ab2c1f6c Show response
configs.knotch.com/v2/ 153 B
582 B 157ms
37ms XHR
application/octet-stream 18.160.200.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://configs.knotch.com/v2/68c7d46d-4f53-496f-99ba-ec17ab2c1f6c
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.200.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-200-92.ord56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cddedd8608723d22a8931d30e123bc6fe3d2657e9567997c2b4434361a04e3fa

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 12:42:37 GMT
via: 1.1 9460f752a7d3e3c136c992fe24fc77e2.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD56-P5
age: 33029
x-cache: Hit from cloudfront
content-length: 153
last-modified: Wed, 03 Apr 2024 15:56:05 GMT
server: AmazonS3
etag: "e06a8fe72f012106da71ba031d0a0cbc"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: ETag
vary: Accept-Encoding
x-amz-cf-id: m9YBDbIoNq2Wzh2t0odGRHU4pDD1IpquvlfinAeE6Y-bEPaIaXDAXw==

POST
H2 200 norton Show response
ingest.quantummetric.com/horizon/ Frame E7BF 90 B
243 B 1340ms
136ms Fetch
application/json 34.134.162.16
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ingest.quantummetric.com/horizon/norton?T=B&u=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&t=1720648383896&v=1720648385110&S=0&N=0&P=0&z=1

Requested by

Host: cdn.quantummetric.com
URL: https://cdn.quantummetric.com/qscripts/quantum-norton.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.162.16 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

53295e39f3ebe4a704171b6730d8c097095cb386cfccd44c9cef524264af63a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:06 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
content-length: 90
content-type: application/json

GET ingress
frontdoor.knotch.it/ 0
0

GET
H3 200 /
www.google.com/pagead/1p-user-list/1069927954/ 42 B
64 B 146ms
57ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1069927954/?random=1720648384128&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v9166610413za200&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&fdr=QA&data=event%3Dconversion%3Bu1%3Dhttps%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story%3Bu2%3Dblog%3Bu3%3Dbusiness-owner-phishing-story%3Bu4%3Dmissing&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLeSbvl1p1shfT7pu8z1Dthj74RvK3sFG8sgXkXHHTRoAjwjCz&random=718573789&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/1069927954/ 42 B
64 B 56ms
56ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/1069927954/?random=1720648384128&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v9166610413za200&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&fdr=QA&data=event%3Dconversion%3Bu1%3Dhttps%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story%3Bu2%3Dblog%3Bu3%3Dbusiness-owner-phishing-story%3Bu4%3Dmissing&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLeSbvl1p1shfT7pu8z1Dthj74RvK3sFG8sgXkXHHTRoAjwjCz&random=718573789&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/1069927954/ 42 B
64 B 96ms
59ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1069927954/?random=1720648384102&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v9166610413za200&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLksu_NiHItSCFil2eJmHqhsv51hJrnlUEQcnXv7o1SVRcLoYC&random=2814341163&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/1069927954/ 42 B
64 B 55ms
55ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/1069927954/?random=1720648384102&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v9166610413za200&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLksu_NiHItSCFil2eJmHqhsv51hJrnlUEQcnXv7o1SVRcLoYC&random=2814341163&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 6 KB
1 KB 63ms
62ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_7NGVH48sIDRo926&Q_CLIENTVERSION=2.10.0&Q_CLIENTTYPE=web

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c70dd670f61bd38994f5aff0fca6245b22d2fda0139ec94f88323bb2e96dfb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 10 Jul 2024 21:53:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
content-type: application/json
access-control-allow-origin: https://us.norton.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 43605809f31248b3
timing-allow-origin: *
cf-ray: 8a13c8d838fba208-YYZ

GET
H3 200 /
www.google.com/pagead/1p-user-list/1043330685/ 42 B
64 B 58ms
58ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1043330685/?random=1720648384629&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLEXJV46UehbAZ4CS6Bp66tvpGGaU0XyimzMaboZ1g9CWsluGX&random=828312544&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/1043330685/ 42 B
64 B 56ms
55ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/1043330685/?random=1720648384629&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLEXJV46UehbAZ4CS6Bp66tvpGGaU0XyimzMaboZ1g9CWsluGX&random=828312544&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.ca/pagead/1p-conversion/1043330685/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?random=125350499&cv=11&fst=1720648384615&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=...
https://www.google.com/pagead/1p-conversion/1043330685/?random=125350499&cv=11&fst=1720648384615&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_...
https://www.google.ca/pagead/1p-conversion/1043330685/?random=125350499&cv=11&fst=1720648384615&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_e...

42 B
64 B

58ms
58ms

Image
image/gif

142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/1043330685/?random=125350499&cv=11&fst=1720648384615&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&label=sale&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&gtm_ee=1&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dbusiness-owner-phishing-story%3Becomm_traffic_source%3Ddirect&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMI_vur3rqdhwMVe0RHAR14DQCQMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6Fmh0dHBzOi8vdXMubm9ydG9uLmNvbS8&is_vtc=1&cid=CAQSKQDaQooLFLg-9Bj4oQ_uVPT6NbpeSN3TKEllbEevbMaPCdR8ntnep7qE&random=344234195&ipr=y

Protocol

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-50-17-194-92.compute-1.amazonaws.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/1043330685/?random=125350499&cv=11&fst=1720648384615&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&label=sale&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&gtm_ee=1&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion%3Ballow_custom_scripts%3Dtrue%3Becomm_pagename%3Dbusiness-owner-phishing-story%3Becomm_traffic_source%3Ddirect&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECSixldmVudC1zb3VyY2UsIHRyaWdnZXIsIG5vdC1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgQKAgID&pscrd=IhMI_vur3rqdhwMVe0RHAR14DQCQMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6Fmh0dHBzOi8vdXMubm9ydG9uLmNvbS8&is_vtc=1&cid=CAQSKQDaQooLFLg-9Bj4oQ_uVPT6NbpeSN3TKEllbEevbMaPCdR8ntnep7qE&random=344234195&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
670 B 413ms
47ms Image
image/gif 50.17.194.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Wed%2C%2010%20Jul%202024%2021%3A53%3A05%20GMT&n=7d&b=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&.yp=11548&f=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&enc=UTF-8&yv=1.16.0&tagmgr=gtm%2Cadobe%2Censighten

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

50.17.194.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.121 /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:05 GMT
via: http/1.1 traffic_server (ApacheTrafficServer/9.1.10.121)
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS/9.1.10.121
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Wed, 10 Jul 2024 21:53:05 GMT

GET
H2 200 2010787619164716 Show response
connect.facebook.net/signals/config/ 76 KB
15 KB 43ms
42ms Script
application/x-javascript 157.240.229.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2010787619164716?v=2.9.161&r=stable&domain=us.norton.com&hme=e67e7d148043b3a377ad0eb1c82669792a67ba5e3bb5734b69e611ae38f939ca&ex_m=68%2C115%2C102%2C106%2C59%2C3%2C95%2C67%2C15%2C92%2C85%2C49%2C52%2C163%2C166%2C178%2C174%2C175%2C177%2C28%2C96%2C51%2C74%2C176%2C158%2C161%2C171%2C172%2C179%2C124%2C39%2C33%2C136%2C14%2C48%2C184%2C183%2C126%2C17%2C38%2C1%2C41%2C63%2C64%2C65%2C69%2C89%2C16%2C13%2C91%2C88%2C87%2C103%2C50%2C105%2C37%2C104%2C29%2C25%2C159%2C162%2C133%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C55%2C60%2C62%2C72%2C97%2C26%2C73%2C8%2C7%2C77%2C46%2C20%2C99%2C98%2C100%2C93%2C9%2C19%2C18%2C82%2C54%2C80%2C32%2C71%2C0%2C90%2C31%2C79%2C84%2C45%2C44%2C83%2C36%2C4%2C86%2C78%2C42%2C34%2C81%2C2%2C35%2C61%2C40%2C101%2C43%2C76%2C66%2C107%2C58%2C57%2C30%2C94%2C56%2C53%2C47%2C75%2C70%2C23%2C108

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.1 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-iad3.fbcdn.net

Software

Resource Hash

277a97719f6e3b2c9c3c68f96e44745fdc72703a8681f220c0d2bbfc54a3a0dd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 10 Jul 2024 21:53:05 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 15297
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=42, rtx=0, c=63, mss=1316, tbw=64169, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: lVB7UecRFwg1965UlbB1vKHH01WvvCqd9MuF7Ih3pc7tI2OaYsSQIVCR0ab6IF6vvvBe2Yuf2pyn2iZ651X1ng==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 130ms
44ms Image
text/plain 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2010787619164716&ev=PageView&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648385637&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=0&o=4125&fbp=fb.1.1720648385634.439321817698886299&cs_est=true&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&eid=96fb7431-858f-46dc-bcf6-a38775d85e2f&tm=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=40, rtx=0, c=10, mss=1316, tbw=2791, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 10 Jul 2024 21:53:05 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
4 KB 289ms
234ms Image
image/png 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=2010787619164716&ev=PageView&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648385637&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=0&o=4125&fbp=fb.1.1720648385634.439321817698886299&cs_est=true&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&eid=96fb7431-858f-46dc-bcf6-a38775d85e2f&tm=1&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-iad3.fbcdn.net

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x8229d9f3867c49cc","source_keys":["1","2"]},{"key_piece":"0xf9634e36de8e164e","source_keys":["1","2"]}],"aggregatable_values":{"1":1}}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Wed, 10 Jul 2024 21:53:05 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7390128542663884863", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=40, rtx=0, c=10, mss=1316, tbw=3109, tp=-1, tpl=-1, uplat=192, ullat=0
pragma: no-cache
x-fb-debug: YTjY3NsDs1V0jHWv9ZE9nhH33cMHvCcr5ada+aPqyDEW+6dTSLvt1T7lzz9CZhTQJATjIdvfNpE03vDqnHvMaw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7390128542663884863"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/b/ 0
106 B 49ms
47ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/b/r.rnc?n=1&c=21&i=4o5w0e&p=aemprod&s=15586&d=8G57InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxLCJwdWJsaXNoUGF0aCI6ImFlbXByb2QiLCJpbnN0YW5jZUlkIjoiNG81dzBlIiwicGFja2V0IjoxLCJtb2RlIjoiZW5mb3JjZVgA8ixvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IlVTIE5vcnRvbiIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdLYA8CBodHRwczovLzY4Nzk0OTEyLmFrc3RhdC5pby8iLCJ0eXBlIjoieGhyIiwic3RhcogAwDcyMDY0ODM4MzgxNHYASmQiOjEUAFBzb3VyYzkAslhIUl9NQU5BR0VSQQAwdHVz8wBhbGxvd2VkmgBAYXNvbpkA1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWYAzzEyODQyMjk5NzJ9LMsA0PYIY2RuLnBkc3QuZm0vcGluZy5taW4uanOaAWJzY3JpcHRcAQqdAT43NTmdAUU4NCwinQHCaW5zZXJ0QmVmb3JlQgACngE_bG9hmwEinzc5MTc0NDc1M5sBBw_QACkvODLQAAAXNdAAMW11dNYCr09ic2VydmVyQ0zWADgvNzbWAAfwDHBpeGVscy5zcG90aWZ5LmNvbS92MS9pbmdlc5sBA0UDA4UDApQACqwBPjg4ONwAJzkx3AB_UkVRVUVTVE0DAVtibG9ja00DYSJXaGl0ZT4DD1gDCQonAAJjA68xOTEzNDg1NTMx8gAuX2ZldGNo8AACHznMAQAnOTPwAF9GRVRDSO4AWS8yMOABDOEtY29uZmlnLnJlZGRpdOUBAvgB0i90Ml9jeHowczRxYS8lAAagAw86BQQ9OTMx8QEBFAAFnQMPOgU-nzA4NTg0NTYzOZ8DCAHRAA_pANEzd3d3yQEA7QYhaWPPATBhZHPAAQPSBxNzCAEAywMBGAEAHAA4Zmln7wGvX3RlbGVtZXRyefIBEA7zAjc5MzLzAg_yAT2_MTk2MTg2MDYxOTHbAgcPCQH_EAH8AQ90BxUvNjDXAwAI2AQPdAc9nzI1NzY5NDA1OOMBIA_aABoPfgcAKDkz2gAPfgdDA-AAHzieBQgzc2MtxQO_bmV0L3NjZXZlbnQpCRkPtQEBGDWaAw-1ATyvMDYwMjg2MTI3N7UBBw_VAC4PsAEBCdUAD7ABQgTbAC85OdsAB6J0ci5zbmFwY2hhRgcCMwcQLzYJ9i4wOGJlZjQ5Yi00YjZmLTQ3NGUtOTU4Yi01YTBiZTdhMDIyN2UuanNvbj92PTMuMjEuMS0yNDA3MDExODUxgwUPagkIHzntAQEAFAAFeQcPagkIH2G3DCafMDk5MjE5OTgxtwwIDxgBTw-QCQYPFgEPD5AJBg8UAVyPbS9pP3BpZD0qAhHxHiZ1X3Njc2lkPTcxN2ViMWUxLWYzM2MtNDE3OS1iYWI1LTVlZjkxYWUyOGRhYy0AEGxaAPYUYWEzYWYyOC1mZmE0LTRmOTgtOWE4ZS03MmMxOWQwMDMyMDJrAlNpZnJhbT4NCtQLLzk24wkAABQABWoC8ghIVE1MSUZSQU1FX1NFVEFUVFJJQlVURTELAosND14BJ58xOTUwMjI5Nzk6BQjyAHB4LmFkcy5saW5rZWRpbgUJYHR0cmlidR4QgV90cmlnZ2VycQHWMjUwNDA2MCZ0aW1lPe8PgTk2NiZ1cmw9RxDRJTNBJTJGJTJGdXMubnwQAFMA8AclMkZibG9nJTJGb25saW5lLXNjYW1zFgD_C3VzaW5lc3Mtb3duZXItcGhpc2hpbmctc3RvUQkRLjY3bAcAFAAFYAEPUQk_nzE4MzQ1MDc5Nd4EBw9UAf9CAC8GMC5saT0QACYG_whsaS5sbXMtYW5hbHl0aWNzL2luc2lnaPQHGw-dAwEXOI4LoGFwcGVuZENoaWwMEQBhCAG6Eg8cESSfMDA0NzM0ODQ0qAkID-YAQA8FCAEYNuYADwUIQwPtAB82BQgLY291dGJyYXcEgHVuaWZpZWRQShH_Xj9vcHRPdXQ9ZmFsc2UmYnVzdD0wMDgwMjcxMDg5NTA5NjQ5OSZyZWZlcnJlcj0mbWFya2V0ZXJJZD0wMDFmOTYxYmQ5YjA1MWEyODE4YjQwNTgzNTNmZGE5MmJmJm5hbWU9UEFHRV9WSUVXJmS7BECyJmc9MCZvYkFwaVYdFpQ9MS4xJm9idHAQAFYyLjAuNUUGgXNlbmRCZWFjrBUNZhU-OTcz6QQAFAAF6QSvU0VOREJFQUNPTjIRAQ9EBiePMDcxNjE2Nzb8EglAYW1wbPUSCc4BV3RvcGljphQPkQkJHjdEFhA5FAAF3gAPkQlBnzE4ODUwNTM4MKQCCQ_bABIPVAkHAMUAImVutxYDMRcK2QAPVAk_D9cAJzBjcC-hAg_oDhUfNXwHACc3Nj8FDzMNPK8xNTgzMTI2MzM0egcHD68BAg_YABwPMQUBCdgADzEFQgTeAB81MQUIAIIGIGljsAlALXR3aSQZAFwJTy91d3S0ARUeNBAYEDl4FgVpAw-0ATuvMTkwMzM2MTM3MtYASg-yAQEJ1gAPsgFBBdwAHzbQDQjxAXdlYnNkay5hcHBzZmx5ZXKwAcc_c3Q9YmFubmVycyYBBg_GGQgOGhgvOTnGGUifMjIwMjAzNzIwNRQJD9oAMg-6AQEJ2gAPugFBFDLgAB8yxAsIABUV0XBheXBhbG9iamVjdHO7AVBtdXNlLwUAD3EDFC85OSUFAAAUAAVxAw9kCgQP0Rk-fzk4MTg1NzitAgo_d3cu8wAxD64CAQhxCg_zAF0P7RgIBuYBAd8B9gx0YWdtYW5hZ2VyL3BwdG0uanM_dD14byZpZD3MDg-zAxIATxIM-QcvOTkdB0efMDE2OTUxOTQxaQUID-0ARg_GAwII7QAPxgNCBPMAHzSmBAjxCHNwaWRlci5hdXN0cmFsaWFyZXZpdmFs7QH_E2kvOGQwOGIxY2YxMmI2ZGVkZDQ2YzY4MGI3ZDFlY2E5MTHlAxQtNzXyAjg0MDKgBQ_yAgQPSQ4jAZ0dTzY2NjFhFQkP-QBTDvkBC_kAD_kBQQQAAS8yMtkDDGFnb29nbGXsAfIQcGFnZWFkL2xhbmRpbmc_Z2NzPUcxMTEmZ2NkPTEzdAIA9Qw1JnRhZ19leHA9MCZybmQ9MTk1NjgzMzc2NS7tEh806hJDkCZkbWE9MCZucAYA8ABndG09NDViZTQ3MzB2OTHrAfgJMDQxM3phMjAwJmF1aWQ9NDkzMjQ1NjUwmQBAZnJtPXwkA2sgD1EOCj40MTC0AgEUAAWZBg9RDkSvMTg4MDIxNDc1MJUUCACqBAK-AQaSBQHIAfAIZ3RhZy9qcz9pZD1BVy0xMDY5OTI3OTVfJQT3AA9HCQgcNUQPODQxMz0iD_0KO68yMjE1MzI5MDYysQwID-oAQw-YAwAK6gAPmANBBfAAHzWRBQgM4RgXcE4HDwIRCT00MzJXHQIUAA-xAk1AMjAwNjgJLzEwbwQIDNcAH2OkGKo4NDMyvgcPvgY6HzKVGBEPTwGqDcwSC08BD3wDQgVWAQ-lAghxYS5xdW9yYUkFEXEiHx9z4ggVHTZ_FE80MzMwzwoQQGVycm84Ki9yZeQpHAAtHU84NzUxLRcID9AAKB840AAND6UBCw_WAC0fM9YACfIEc3NldHMuYm91bmNlZXhjaGFuZ8UIEWEaAHAvc21hcnQtCQcDpiRgZWQvcnVulRv_FV82NDU5NzM4MDI2NTM1Y2RhNDIzMmRjODEzYzYxNDQ3ZC5icvMBE000MzM2LgcBFAAFcAUAuxwRU24HD7scP58xOTMzODk0OTT1IQn_A3RhZy53a25kLmFpLzIwMDQvadwAEz0zNzaIJUc0MzM3zwIP8wQ7nzA4Mzg2NDUwMxkHCQ_NACYP7QcACs0AD8wCCw-FDCMUMtQAD-0HCWFzLnlpbWdwBCR3aTsnUTExNTQ4wSEG-wcPIikDPjQzM6UKARQABYQCD98dPa8yMjE5MDcyNzIzSA8ID9cA0j95dGNOAxYNSB04NDMzQQgPWAs8nzE0MDQwOTA1MTwlCQl7Ag_NABgPTgMCCM0AD04DQgTTAA8ZBgkA7wQgc2lrG4AuZmkvc2lmaQQG9hVhZThmMWE5MC03YTBjLTAxMzktNDA4My0wNmFiYzE0YzBiYzZpAw8rMAgfNvAFABg04wcPFAU6rzE5OTU1MDA4MzNiLggP8gBMDwUIAQnyAA_rAUEF-QAPIzEJVHMucGluOwVgY3QvY29y9CYPyAETDuYOKDM0RzAPjgM9fzM1Njg0MTMRIwkP0AApD6YBAgjQAA-mAUEiMjHWAC80MVALCQR9InEudGlrdG9r6QZRaTE4bi9WKxUvYwv_FD9zZGtpZD1DNEpTQVJKUjJRM09HMEpBRVRGMCZsaWI9dHRx2wETD7cIAB80pSpJfzUyNjQ4NTakAwkFgiMPBQFVD6EFAQkFAQ8QAkITMAsBHzWvBAjyJHpuN25ndmg0OHNpZHJvOTI2LWdlbmRpZ2l0YWwuc2l0ZWludGVyY2VwdC5xdWFsdHJpY1Ya8ApTSUUvP1FfWklEPVpOXzdOR1ZINDhzSURSRQAPGgITD3UOAADsHQUpCQ-9BTqfMjEyNjQ3NDk41x0JDw4BaA8zBAIPxAdPAxUBD-AlCQ_vExGvREMtODEzNjQ4N_sBEw1iHD80MzjWFEifMDkxMDkwNzc09x4JP3d3LsAVDQ_nABwP1AEBCecAD_cDQwPtAA9cMQnxAGQuaW1wYWN0cmFkaXVzLfYFAQsG_xRBMjQ3NDUyLTE2ZWEtNDZhMS1iZjNlLTBkOWU0NTE4ZmY5Y2MaFh44_hQoNDCeCQ_WBzvgMTk2NDkwMTM4MTR9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:05 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/b/ 0
106 B 45ms
43ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/b/r.rnc?n=2&c=21&i=4o5w0e&p=aemprod&s=15604&d=8G57InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxLCJwdWJsaXNoUGF0aCI6ImFlbXByb2QiLCJpbnN0YW5jZUlkIjoiNG81dzBlIiwicGFja2V0IjoxLCJtb2RlIjoiZW5mb3JjZVgA8ixvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IlVTIE5vcnRvbiIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdLYA8FBodHRwczovL2QuaW1wYWN0cmFkaXVzLWV2ZW50LmNvbS9BMjQ3NDUyLTE2ZWEtNDZhMS1iZjNlLTBkOWU0NTE4ZmY5YzEuanMiLCJ0eXBlIjoic2NyaXB0Iiwic3RhcrgAwDcyMDY0ODM4Mzc4M6YARGQiOjEUAPEDNDQwMCwic291cmNlIjoibXV0mQCxT2JzZXJ2ZXJDTCJIAKF0dXMiOiJsb2FkzgBAYXNvbs0A1F0sImRhdGFQYXR0ZXISALFsaXN0IjpbXSwiaWoA3zE5NjQ5MDEzODE3fSz_AAWydHI2LnNuYXBjaGH3ACZwItEAcWVuZEJlYWNLAQzVAE80NDA51QAAFznVAPgDU0VOREJFQUNPTl9NQU5BR0VS1QBvYWxsb3dl2AAgvzIwNDU2MDY1MTQw2AAHEW4DAvYDLm93NWEubmV0L3h1ci80NDA13gAyeGhyjwAYcqwBPzQ0MawBAAAUAAWsAT9YSFLQADq_MTkwMzQzNzY2NTHQANeBYmF0LmJpbmdrAyBhY5UD8KwvMD90aT01NDQxNjExJlZlcj0yJm1pZD1lYjczNTFlMi1iNTA0LTQzZDMtOGE3Mi1mNGQ1ZTEwNGE0YjQmc2lkPWM4ZGYyYTkwM2YwNjExZWZhNGM1Y2YxNzVhY2EyZDBlJnZpZD1jOGRmMzY5MDNmMDYxMWVmYTEzYTIxMDExYzY4ZTljOCZ2aWRzPTEmbXNjbGtpZD1OJnBpPTkxODYzOTgzMSZsZz1lbi1DQSZzdz0xNjAwJnNoPTEyCADwHmM9MjQmdGw9VGhlJTIwdG9sbCUyMG9mJTIwYSUyMHBoaXNoaW5nJTIwc2NhbRsAE24bADFzbWEsAIBidXNpbmVzcxwAcXduZXImcD2lBMMlM0ElMkYlMkZ1cy7XAvAFY29tJTJGYmxvZyUyRm9ubGluZS1XABBzFgADRwAgLW9FABQteQD2Jy1zdG9yeSZyPSZsdD0xODQ2JmV2dD1wYWdlTG9hZCZzdj0xJmNkYj1BUUFBJnJuPTYxMDg0Ny8DP2ltZy8DAgDYBSFlbnEEA-8EIDQ0FAAFLwPyB0hUTUxJbWFnZV9TRVRBVFRSSUJVVEVMAALfBA8KBCa_MTg2MzQzNDQxOTg6AwcJagIADQAfarQFEx833wQAJzIy3wTIaW5zZXJ0QmVmb3JlzwAPrgUjrzIwNDk1MDI2ODQGBAgAvwAFNgMADQAPzAAUD4AGAQnMAA-ABkEG0gAfNZ4BB_EBYW5hbHl0aWNzLmdvb2dsZRAE9DxnL2NvbGxlY3Q_dj0yJnRpZD1HLUZHM00yRVQzRUQmZ3RtPTQ1amU0NzMwdjg4MDc0ODQ0NHphMjAwemI5MTY2NjEwNDEzJl9wPTFwB_AEMzc1NSZfZ2F6PTEmZ2NzPUcxMQkAUmQ9MTN0AgCgNSZucGE9MCZkbQYA9gp0YWdfZXhwPTAmY2lkPTEyMTcwOTk0NjYuwgciJmUbAKAzMjA1Mzk3JnVsGwRgY2Emc3I9GwQReBgE0GlyPTEmdWFhPSZ1YWIFADBmdmwHAIBtYj0wJnVhbQwAEXAFABB2BgDxGHc9MCZhcmU9MSZmcm09MCZwc2NkbD1ub2FwaSZfZXU9RUEmX3M9MfAEB4sAMHNjdBUAIGVnwQAfbDgEQC9kdNkEOCFlbnkEgF92aWV3Jl9mewSQX25zaT0xJl9z3QAgX2UBAfYCdGZkPTI1MzAmX3o9ZmV0Y2iNBAPYCQJ2AwvABy43NpcIABQABZEEf1JFUVVFU1TEBzyPNDY2OTQ2OTG-AwgP7AL__yUE-wIOgQsA1gIMewcnNzeiBl9GRVRDSOgCX_EEc3RhdHMuZy5kb3VibGVjbGlja4QLD9cFDAJOBQ9pBQEP8QUVU2FpcD0xwQUP5QULAV0FBlAEH3PqDAsAVQEPaQEKD-oMRp83NTkyMzc4MDZCBwczd3d3PAeidGFnbWFuYWdlckYHfHRhZy9qcz8_ByBsPTwOp0xheWVyJmN4PWMHAQ_CDgU_NDA5DgkAJzgxbAIPDgk7nzE5NTEzNDYyM-QNCQ_6AFI-MTM1UAYJ-gAPPAlBBQABHzf6AQjCdGFnLmhhdmFzZWRnOQmPanMvZXZ0bmOYEBUfNiwHABg4QgSgYXBwZW5kQ2hpbKkPANkDD5EQKK8yMjAzOTAyMzA0rwsID9UALw_tCgEJ1QAPsQFBBdwAHzbtCggPsQIdD5oDEE4zODA0oAInOTOaAw_vAEG_MTk1MjkzNzA1NzKaBAeyY3QucGludGVyZXNcEmB1c2VyLz_QC_ENMjYxMzE1ODY0MjgxMiZwZD0lN0IlMjJucCUyMvAOoDJlbnNpZ2h0ZW4SAFY3RCZjYs0L9gc0NTI0JmRlcD0yJTJDUEFHRV9MT0FELgEP2xEELjUyywMBFAAFGwoP2xE9rzIxNzM5NzExOTTHAwgPJwH_FRBzTQIiaW0yEv8EY3QvbGliL21haW4uZWExYzkzOfUEFE00MzQwMQM3NTI2MQMPywY9jzA0MDk3MDcy9gQID90ANx8x3QAMDw4EQwTjAB85DgQHAK8QH2LyE__FCkADD2MCC0BlcnJvehcvcmXOGBsP7BMeD1YW_6sfMscEHBJBDBICURYPYwIuD8cECAbFEWF0aWt0b2trDcZhcGkvdjIvcGl4ZWyHCA9WDgsuNTdpGjc1NzSIBg9WDkS_MTg1MDQyMjIzODSuBQcP5wACQmkxOG7lABAvCwwiaWOBB-9NV1UyTkRFell6SmlNUXwMEz80MzTjAQAJ_wAPRwQLD2YXI68xOTM0ODE5MDkzuAoIsWFwcC5sZWFkc3J43gH_HnZpc2l0b3IucGhwP2FjY3RUYWc9Y3NpeXJrNDI1MDImdHo9NDIwJnJlZj0mdXwVQA97FTnxA2xjPW51bGwmYW5vbj0wJnZpbhAABrUCDzwLBQ9tEgAQNRQADzwLR48wNjE5MTg0NxcdCQ-rAf-xD8MaFB82vA0AAJgTBYACD7YLOzAyMTG8DT8zNTbRFwkPKQQED9MAFA-pEAAZNdMADwIFQQXZAB835QYIDZMOL3YzuA8lAVEjdD1pbml0JmHnDzBsb2PWDwDYHh8y4x4-AFoAgDJDJTIycmVmDAABZgAACQABFQATaRQAYWZhbHNlJRMAIHNoHgAgM0GvGwMSABN3EgAyNjAwEgATbSQANCUyMm8OACMAAUAAUGlzX2V1DgBTM0F0cnVVAMJhcmNoaXRlY3R1cmUcAAAGABAysRBiJTIyYml06h8D7RABHAAAtABgYnJhbmRzDwCDM0ElNUIlNUSAAENvYmlsSQAHuwAAGCUTbC4AAFwAA18Aj3BsYXRmb3JtGgAHEla-JQ4hAG91YUZ1bGwfAAayZWNtX2VuYWJsZWQ8AAHyAA2fERc3OSAPrBsIPjU3OOcJABQABdUDD6wbQq84ODIzNTAyMjEzAAkHDwID__87D8IbBg8AAw8PwhtAD_4CEQmsESNwL0oPA5slD-ELFD40MTfdAxg5aBMPXRg7nzE2ODAzMzU4MdoLCA_YADIA3iQLDhwZNdgAD7cHQwTfAA9KFggvdHLMKSQvNTmJBQAAFAAFiQUPjA5ErzIwMDY3ODYyMzhnCQgPNxkR70FXLTEwNDMzMzA2ODUm4xwhHzOPCQAQNv0bBQQBD2IKPY8zNDMzMTI4MrECCA_7AFUORBoK-wAP0wJDBAEBD4gHCBJpBxoQLo4P8Qx2ci5vcmcvdHJhY2svdXA_YWR2PTllNWIzYnN9Dw9LCj7xBiZ1cGlkPWppcnJtem0mdXB2PTEuMewuA_MtU2lmcmFt_ScKhyQuNjX-BAEUAAVOAgEYKV9GUkFNRRkpPwAjLW84OTMzNjd0GAgoanNWATB1cF9TETFlci7kAA_lBRMgMzcKHwsNBQrnAA81AzuvMTg2OTAyNjMyMDUDCA_ZADMOnhMK2QAPEwNBBt8AD5sTL_8CaWRlbnRpZnlfY2UxZDg4NDPTARM-NDU1FSAoNjZRHg_TATyPOTM1ODQ1MTIkHQkPjxQUD_QAJh423yIoNjaMFQ_uAUIE-gAfNYsPGQN6Ff8AY3QvdG9rZW5fY3JlYXRl3QEULzY03QEACXIND90BPJ84OTc2MDcwMTWJBAgNbA0P4wAsD8wBAAnjAA_MAUIE6QAPMBIKBe0sDzwYBABqCwaLFQ9AGAsuODfrHQEUAAViBg-0CUS_MTkzMzI4ODU1OTdADweAdHIub3V0YnKhHwBONXBjYWNoZWRDDCj3IUlkP21hcmtldGVySWQ9MDAxZjk2MWJkOWIwNTFhMjgxOGI0MDU4MzUzZmRhOTJiZhEBD6AmBS8zOU0ZACg4OMEDD20MOp8xOTI5Njc0OTdDEAkPAwFeDiIVCgMBD_gCQgUKAQ_4JAjiY29uZmlncy5rbm90Y2hUGfcWMi82OGM3ZDQ2ZC00ZjUzLTQ5NmYtOTliYS1lYzE3YWIyYzFmNpwoD5gYAz01MDT2AAIUAAUGAw_UIz6fMjQ3NjYwNTQ2twoID_IAXghYDw_yAGIAqgwC4AFBLWNkbuQBEGuBKnBsYXRlc3QvDABwLm1pbi5qc0QbIG91FjofPQMCGx9z_wMGEDesBwqHCiA1MOsGBQYCD_8DOq8yMDA1MzQwNjUz9QIIDxEBaw7NDgsRAQ8NBEEFGAEfNb8KCA3uB2djdC5odG04Hw9WDQgA1AEL6AE3MTE1NB8P6AE64DE5NTczOTU0NzUwfV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:05 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:04 GMT

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/b/ 0
106 B 44ms
44ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/b/r.rnc?n=3&c=21&i=4o5w0e&p=aemprod&s=12454&d=8G57InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxLCJwdWJsaXNoUGF0aCI6ImFlbXByb2QiLCJpbnN0YW5jZUlkIjoiNG81dzBlIiwicGFja2V0IjoxLCJtb2RlIjoiZW5mb3JjZVgA8ixvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IlVTIE5vcnRvbiIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdLYA8AlodHRwczovL2N0LnBpbnRlcmVzdC5jb20RAPAMaHRtbCIsInR5cGUiOiJpZnJhbWUiLCJzdGFykADANzIwNjQ4Mzg0NjQ5fgBEZCI6MRQAsDUxMTUsInNvdXJjPAAxbXV0cQCiT2JzZXJ2ZXJDTEgAoXR1cyI6ImxvYWSmAEBhc29upQDUXSwiZGF0YVBhdHRlchIAsWxpc3QiOltdLCJpagDfMTk1NzM5NTQ3NTN9LNcABdBhbmFseXRpY3MudHdpTgAB3ADyMmkvYWRzY3Q_YmNpPTMmZWNpPTImZXZlbnRfaWQ9NDRmM2E2MTktNDg2Ny00NDQ3LTk0YjgtNjlmZTY2YzFiNDM0LgBQcz0lNUIDAPAJMjJwYWdldmlldyUyMiUyQyU3QiU3RCU1AwAQJlYBIWdy_wDQPWFkdmVydGlzZXImcGwAElSVAHAmcF91c2VyEgBAMCZwbAgA8B1mZWIzYmZlNy1lNzAxLTRjYTYtYjY4NC1iMWY2OTU3YTQxZTMmdHdfZG9jdfIBYV9ocmVmPc4B0SUzQSUyRiUyRnVzLm4DAgD1APAHJTJGYmxvZyUyRm9ubGluZS1zY2FtcxYA8A11c2luZXNzLW93bmVyLXBoaXNoaW5nLXN0b3J5YwAC-QGQX3N0YXR1cz0wEwDib3JkZXJfcXVhbnRpdHkUALBzYWxlX2Ftb3VudBEAIHhuxwBgbzVmdW0mQgLDPWphdmFzY3JpcHQmNQMQPSEDEDM0AwAhAABjAiJtZxgCCWACTjM5ODdgAiczOWACoGFwcGVuZENoaWxJAgKqAA9ZAievODUyODU4NDczN1kC_88fOFkCDA-5BEIFYAIfOGACBwCFBR8vqAQK_xUxN2M5ZDJhYy02NTk5LTRiYmQtYmRjOS1mNTZkNjgwYmM2NDGoBP8XX251emlwqARCHzaoBEa_MjI0NjM4NDM2MjlIAv--D5cEAAlIAg-XBEEFTwIvMzBPAgcPUAkgD6gE_5Q_MjA0UAlFvzIxMzcyOTA5NDkxWQL_zw65BApZAg-5BEIFYAIfMmACB_ANZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L70NMGFkL8ANo3Rocm91Z2hjb26kDPUFLzEwNjk5Mjc5NTQvP3JhbmRvbT3mDus0MTI4JmN2PTExJmZzdBgAQWJnPWYBAPImJmd1aWQ9T04mYXN5bmM9MSZndG09NDViZTQ3MzB2OTE2NjYxMDQxM3phMjAwJmdjZD0xM3QCAFA1JmRtYU4N8AFhZ19leHA9MCZ1X3c9MTYwCQAwaD0xMQA_dXJs-A1AdWhuPXd3dy43AXBlcnZpY2VzSg5AJmZybZQA9AtpYmE9VGhlJTIwdG9sbCUyMG9mJTIwYSUyMEQOMCUyMGYOABsAE24bADFzbWEsABNidg4AHAAAeA4wJm5w6QDQcHNjZGw9bm9hcGkmYTcBpjQ5MzI0NTY1MC52AYAmZmRyPVFBJiQQET24DzYlM0SzAY8lM0J1MSUzRA0PPgBZAEEyJTNESA9AM0J1MwwAA8gADz4PAgAxAPAENCUzRG1pc3NpbmcmcmZtdD0zJgYAABYSA_YOAhUPD_kOAE00MTM0oAwfMvkOSJ85NzAyMjQwMzepBQgFEgIPSQP__50fNUkDDA-ZBkEVMVADD5kGXy8wMpkGAz8wMiaZBv9dr2d0YWcuY29uZmkBBiAuMja4Ai80MaoLRp8wODcxMDUyMTFSEAgPAQZED7EC_7UfM2kFAAmxAg9pBUEUMrgCHzJSFSoP-hn_gg8ABQAfOKoQRr8xOTYxOTUxODg3NEoOBw-aFw8PSAL_gg-ZEAAJSAIPlwRBBk8CHzZPAgdAc2l0ZSMewHJjZXB0LnF1YWx0crAeAIQfcFdSU2l0ZUmXHwAeAPU4RW5naW5lL1RhcmdldGluZy5waHA_UV9ab25lSUQ9Wk5fN05HVkg0OHNJRFJvOTI2JlFfQ0xJRU5UVkVSU0lPTj0yLjEwLjAXAIZUWVBFPXdlYuQfP3hocogOACA1Mx0UIWVudx8D9R8CFAAF4R-yWEhSX01BTkFHRVJBAALaH2BhbGxvd2WUHS9yZd0fGq8yMDc4MTkwOTI0iw4IDzsBpwgcIQ87AX7_HWR4anNtb2R1bGUvMTIuZjgzNjU2ZmJjNmM5ZjAyMDYxYjIuY2h1bmsuanM_YgIUuSZRX0JSQU5ESUQ9lSAGegIPBREHLjM0vAMoMzBCAQ-8A0G_MjA4MzU3MzU3MDW8AwcPCwsojzQzMzMwNjg1VRQAPzYyObwNAgAYAA-8DRQwODc4nBQhNjRUFCZ6YmUUD2AU_xOAdWFhPSZ1YWIFADBmdmwHACBtYn0VIGFtDAARcAUAEHYGAD93PTCOFAIP9Q0pHzb2EwAvMzX1DUefMjc4MzM2Njc2pgYID-oC__9HDi4OCuoCD9sFQgXxAg_gJQgP_RgFBC0aBm8YPy8xMM0FCS8xNc0FAy8xNYkTFQ_NBQpvcz1HMTEx1gV1YGxhYmVsPQooHyZBGl6PZ3RtX2VlPTFKGhoP6gUib2NhcGk9MX8aCAH3CoJfY3VzdG9tX9oI8AJzJTNEdHJ1ZSUzQmVjb21tX3UcT25hbWVEGhACMQCCdHJhZmZpY190C58lM0RkaXJlY3RVGh4fNlQUAC80MF8GSI8xNjA2NDIyNpwRCA9uA___yg8RFQAKbgMP4wZDwDE2MDY0MjI3N31dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:05 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:04 GMT

POST
H2 200 mon Show response
bite.australiarevival.com/ 0
122 B 46ms
44ms XHR
application/json 50.16.211.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bite.australiarevival.com/mon
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-211-97.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:06 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H3 200 2053905694837980 Show response
connect.facebook.net/signals/config/ 22 KB
3 KB 44ms
43ms Script
application/x-javascript 157.240.229.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2053905694837980?v=2.9.161&r=stable&domain=us.norton.com&hme=e67e7d148043b3a377ad0eb1c82669792a67ba5e3bb5734b69e611ae38f939ca&ex_m=68%2C115%2C102%2C106%2C59%2C3%2C95%2C67%2C15%2C92%2C85%2C49%2C52%2C163%2C166%2C178%2C174%2C175%2C177%2C28%2C96%2C51%2C74%2C176%2C158%2C161%2C171%2C172%2C179%2C124%2C39%2C33%2C136%2C14%2C48%2C184%2C183%2C126%2C17%2C38%2C1%2C41%2C63%2C64%2C65%2C69%2C89%2C16%2C13%2C91%2C88%2C87%2C103%2C50%2C105%2C37%2C104%2C29%2C25%2C159%2C162%2C133%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C55%2C60%2C62%2C72%2C97%2C26%2C73%2C8%2C7%2C77%2C46%2C20%2C99%2C98%2C100%2C93%2C9%2C19%2C18%2C82%2C54%2C80%2C32%2C71%2C0%2C90%2C31%2C79%2C84%2C45%2C44%2C83%2C36%2C4%2C86%2C78%2C42%2C34%2C81%2C2%2C35%2C61%2C40%2C101%2C43%2C76%2C66%2C107%2C58%2C57%2C30%2C94%2C56%2C53%2C47%2C75%2C70%2C23%2C108%2C190%2C189%2C191%2C196%2C197%2C198%2C194%2C186%2C125%2C127%2C155%2C185%2C187%2C116%2C149%2C138%2C143%2C180%2C122%2C222%2C109%2C120%2C121%2C223%2C157%2C113%2C129%2C117%2C146

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.229.1 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

882e47d6fc396e20d9238bd67789c011587b6f8a272b85710058e32a41c1bf80

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 10 Jul 2024 21:53:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2962
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4336, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: e/twyz0XdrLArR5LBjJd12/lvLvYCjLiPW9bNXFC3N7qhQvH0ck5BdKhtUPO94b8Ejyg9qDDCTxD4AEHFsYD8w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 47 KB
0 0ms
0ms Script
application/javascript 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a97bc8ec679a82ec782bd76c7302c0ca394c1ad672450f86f87bee5e0ec06b19

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:03 GMT
content-encoding: gzip
last-modified: Mon, 08 Jul 2024 16:08:41 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 60D7472D7D4A4080BC80A104F3AA8A06 Ref B: YTO01EDGE0816 Ref C: 2024-07-10T21:53:04Z
etag: "804a6d1951d1da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13828

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/ 3 KB
1 KB 75ms
74ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?random=1720648386410&cv=11&fst=1720648386410&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

285c6d2bb0d346f0d9a149f300c4b6e44e5d2ac15f4eb05aab730fc0b08a9271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1441
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/1043330685/ 3 KB
2 KB 62ms
62ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1043330685/?random=1720648386418&cv=11&fst=1720648386418&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&label=23KzCJj-jYMYEP3sv_ED&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&gtm_ee=1&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f156.1e100.net

Software

cafe /

Resource Hash

62e4a55c9ae677d0e8bf5102bc35265846efa0d80281d8ee51877ddb15586f59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1601
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
125 B 45ms
44ms Image
text/plain 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2010787619164716&ev=CHEQ&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648386407&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=1&o=4125&fbp=fb.1.1720648385634.439321817698886299&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=46, rtx=0, c=10, mss=1316, tbw=6900, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 10 Jul 2024 21:53:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
1 KB 108ms
107ms Image
image/png 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=2010787619164716&ev=CHEQ&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648386407&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=1&o=4125&fbp=fb.1.1720648385634.439321817698886299&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xd8f2453a1d18d9ca","source_keys":["1","2"]},{"key_piece":"0x6a84e7d63473c30e","source_keys":["1","2"]}],"aggregatable_values":{"1":1}}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Wed, 10 Jul 2024 21:53:06 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7390128546049258504", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=44, rtx=0, c=13, mss=1316, tbw=7458, tp=-1, tpl=-1, uplat=66, ullat=0
pragma: no-cache
x-fb-debug: sMlZo0xrShCORFcjtYYAIZ2KQD4HVkkbM48gzGaTQruQ+4ugigpdJcSmTd9igPEexVzH1bvZXnzc3TXJKna/fA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7390128546049258504"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

/
www.google.ca/pagead/1p-conversion/1043330685/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1043330685/?label=23KzCJj-jYMYEP3sv_ED&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?label=23KzCJj-jYMYEP3sv_ED&guid=ON&script=0&ct_cookie_present=false&random=39988913&crd=CKG4sQIIscGxAgiwwbECCLnBsQI&pscr...
https://www.google.com/pagead/1p-conversion/1043330685/?label=23KzCJj-jYMYEP3sv_ED&guid=ON&script=0&ct_cookie_present=false&random=39988913&crd=CKG4sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIv8bu3rqdhwMVcWN...
https://www.google.ca/pagead/1p-conversion/1043330685/?label=23KzCJj-jYMYEP3sv_ED&guid=ON&script=0&ct_cookie_present=false&random=39988913&crd=CKG4sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIv8bu3rqdhwMVcWNH...

42 B
64 B

83ms
83ms

Image
image/gif

142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/1043330685/?label=23KzCJj-jYMYEP3sv_ED&guid=ON&script=0&ct_cookie_present=false&random=39988913&crd=CKG4sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIv8bu3rqdhwMVcWNHAR0kOAx9MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6Fmh0dHBzOi8vdXMubm9ydG9uLmNvbS8&is_vtc=1&cid=CAQSKQDaQooLP6XQh53t4xJC8cfuYWdJSRK4yDytrP6jIDfnJ3ma8C1PIGfD&random=2026047731&ipr=y

Protocol

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/1043330685/?label=23KzCJj-jYMYEP3sv_ED&guid=ON&script=0&ct_cookie_present=false&random=39988913&crd=CKG4sQIIscGxAgiwwbECCLnBsQI&pscrd=IhMIv8bu3rqdhwMVcWNHAR0kOAx9MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6Fmh0dHBzOi8vdXMubm9ydG9uLmNvbS8&is_vtc=1&cid=CAQSKQDaQooLP6XQh53t4xJC8cfuYWdJSRK4yDytrP6jIDfnJ3ma8C1PIGfD&random=2026047731&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tc_imp.gif
bite.australiarevival.com/tracker/ 43 B
79 B 46ms
46ms Image
image/gif 50.16.211.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bite.australiarevival.com/tracker/tc_imp.gif?e=37dfbd8ee84e001268eec131e244829b9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5d15856a2717071a10acf9f29f671fd4878c027e391dac7b7750846fda64940d645022945b005f610c56c1b86f4c77be26bb25cb43e2923ff94c67a4132c7c0fd857e854e285929c68f37950aa2084ba5f7ff35b7b1a2d18c8c9077af562b78ed7e2465fc110d1f271f869d26dab56811c30df6d45a54121517eb0106ab9dabff379ec7bfd1ea76b97330d6fa98b6e226e6a2ed036d2c200e0776dbaccec77527b20d0982e3e8b9e5c0e4915275649fe9129637a19a7fc5b659ee9a06f82ea49751d7aaaa6a19dcd21efdbdc0bb857980e6f62c5bdceb6f132c18eb069963508c3e5db724d04fd656da9960876ab9aa7668514a702f6c45bc850d48a3cda666ad4dd78867bc38db5ecddb3bc4e35a971eae2a47c4c77ef823ed3ab10f6061f5f821e19988f96c4c6ecca22c221c194be847da16d6d3994636bdad497496788bb3deb11e0905c9b7bef25131a0f8276be4d84878f5cf8c978c75cbfdc929b708d191c3eb31e04547a4e6ed7ab73f41d948cc964a49425a5d000d792fff371cffea753656a83ec5d52d0ba051a5ab4e0a27ab66dcb9900b6b570f605f4239f41c906cbba6a95697bbdfbcc22466b720938164e0bb8a3d07ed869b446475f2afab253de98180cfea4debabc6cc1f1e5fc86f8abed4a4f3cfb409ab7596e814b791ad7635e7070f77baf751edeeadd7e8968d43996a82bc4a41098780d3d3d047c12f1dcf68f79220188125794cdd8bcb2ca550196b3b57988851020808b7b746999dbd91045f764c04d8308a07ac246c9c201f9a433e59988d49c4f61e7e42563fc01e2dae8cb52956b307e04eb6b0342adb11bcab540d89389c94acc80853308334fbd35af1bac26c7c53af26f3948287b230b823bca932f47fb2f96b5ff5eb4d35fce302abd1b7c308dbc804e0b922ea6df5483586f621feb6273dcbddd69d7456acfc701abdcdef69c509a0004301ff36b3712c1c54e4eb03fe4f7dd3fcf8eae1c577cbe787f4b579e055ae785fc4752c33733c19d8442c0c8a8901a71f822b10776449d0d3175d7d1064388deffc4bbf16aa148fa31867e98d155d6e7ae7a6bacd30d&cri=1z00ldSt5H&ts=2252&cb=1720648386424
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-211-97.compute-1.amazonaws.com
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
BLOB 200
OK b58dfc26-1209-43fd-9419-ffba0fb6aa8a
https://us.norton.com/ 261 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://us.norton.com/b58dfc26-1209-43fd-9419-ffba0fb6aa8a
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf8da8fd439a13ccafbd597e3733bc63f8c12dfb69280fbd8e2873199625e73b

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length: 261
Content-Type

GET
H2 200 187010577.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 61ms
60ms Script
application/javascript 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/187010577.js

Requested by

Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

22f8b5742f36975c1f0d054e483b4ef14eaab3c472c81558115f431dfee721a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Wed, 10 Jul 2024 21:53:05 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CA31AC02403841F9A0C43776D2CA2B03 Ref B: YTO01EDGE0816 Ref C: 2024-07-10T21:53:06Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ 0
238 B 93ms
92ms Image
text/plain 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=187010577&Ver=2&mid=df751c17-7610-4175-9551-a9f38140f5fa&sid=c8df2a903f0611efa4c5cf175aca2d0e&vid=c8df36903f0611efa13a21011c68e9c8&vids=0&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&tl=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&p=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&r=&lt=1846&evt=pageLoad&sv=1&cdb=AQAA&rn=821091

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 10 Jul 2024 21:53:05 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C2F82FF943094F7DB8BBD703F26ADD41 Ref B: YTO01EDGE0816 Ref C: 2024-07-10T21:53:06Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
237 B 93ms
93ms Image
text/plain 204.79.197.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=187010577&Ver=2&mid=df751c17-7610-4175-9551-a9f38140f5fa&sid=c8df2a903f0611efa4c5cf175aca2d0e&vid=c8df36903f0611efa13a21011c68e9c8&vids=0&msclkid=N&ec=CHEQ&el=Invalid_Users&ev=0&ea=Invalid_Users&en=Y&p=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&sw=1600&sh=1200&sc=24&evt=custom&cdb=AQAA&rn=939911

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 10 Jul 2024 21:53:05 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 71AA9D42EAA64B1C804F897A1F8BE3D9 Ref B: YTO01EDGE0816 Ref C: 2024-07-10T21:53:06Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 79913d63-8719-40c4-8e8d-95361dd9f16c
https://us.norton.com/ 529 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://us.norton.com/79913d63-8719-40c4-8e8d-95361dd9f16c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ee1d506d22a757f9a624b66404671f4e1e053eb2b70288e765acd8e80870834

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length: 529
Content-Type

GET
H2 200 /
www.facebook.com/tr/ 0
103 B 43ms
41ms Image
text/plain 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2010787619164716&ev=CHEQ&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648386456&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=2&o=4125&fbp=fb.1.1720648385634.439321817698886299&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=46, rtx=0, c=10, mss=1316, tbw=7139, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 10 Jul 2024 21:53:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
1020 B 108ms
107ms Image
image/png 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=2010787619164716&ev=CHEQ&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648386456&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=2&o=4125&fbp=fb.1.1720648385634.439321817698886299&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xd8f2453a1d18d9ca","source_keys":["1","2"]},{"key_piece":"0x6a84e7d63473c30e","source_keys":["1","2"]}],"aggregatable_values":{"1":1}}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Wed, 10 Jul 2024 21:53:06 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7390128547530759688", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=42, rtx=0, c=18, mss=1316, tbw=8697, tp=-1, tpl=-1, uplat=65, ullat=0
pragma: no-cache
x-fb-debug: raxjhDvP4d3X0mpJWm7yPZYV3Ifr6KauJNia+6vsEllsL3PCEVnllhR1uqWgKcooP5sH8pw7WjCRzG6GQHdSWw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7390128547530759688"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
102 B 44ms
42ms Image
text/plain 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2053905694837980&ev=CHEQ&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648386457&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=0&o=4126&fbp=fb.1.1720648385634.439321817698886299&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=46, rtx=0, c=10, mss=1316, tbw=7312, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 10 Jul 2024 21:53:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
1 KB 109ms
108ms Image
image/png 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=2053905694837980&ev=CHEQ&dl=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&rl=&if=false&ts=1720648386457&sw=1600&sh=1200&v=2.9.161&r=stable&a=tmensighten&ec=0&o=4126&fbp=fb.1.1720648385634.439321817698886299&ler=empty&cdl=API_unavailable&it=1720648385570&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xee70411f3946a9f3","source_keys":["1","2"]},{"key_piece":"0xdeb3643a33b59a41","source_keys":["1","2"]}],"aggregatable_values":{"1":1}}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Wed, 10 Jul 2024 21:53:06 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7390128545978998906", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=42, rtx=0, c=18, mss=1316, tbw=9739, tp=-1, tpl=-1, uplat=67, ullat=0
pragma: no-cache
x-fb-debug: YWhj7TcpnyW/QM9lj6ounSCB0Y2yNGX7OBprAmgnmBk6dfDE9xeV3HOTJwDjj5wyScTT9X9BSFl4H17p2S6RFg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7390128545978998906"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 norton
ingest.quantummetric.com/horizon/ Frame E7BF 0
0 103ms
99ms Fetch
application/json 34.134.162.16
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ingest.quantummetric.com/horizon/norton?T=B&u=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&t=1720648383896&v=1720648386463&H=c2028f6673bd1ec2effc56a2&s=48be5c7ecae2f98573ec67f274f64da2&Q=1&Y=1&X=ca87ec4627204f1abfcf82b850ba7c07&z=1

Requested by

Host: cdn.quantummetric.com
URL: https://cdn.quantummetric.com/qscripts/quantum-norton.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.162.16 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:06 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
content-length: 0
content-type: application/json

POST
H2 200 norton
ingest.quantummetric.com/horizon/ Frame E7BF 0
0 103ms
101ms Fetch
application/json 34.134.162.16
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ingest.quantummetric.com/horizon/norton?T=B&u=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&t=1720648383896&v=1720648386468&H=c2028f6673bd1ec2effc56a2&s=48be5c7ecae2f98573ec67f274f64da2&U=8d12f31957fe215c3d60e8c244048c30&Q=2&S=0&N=0&z=1

Requested by

Host: cdn.quantummetric.com
URL: https://cdn.quantummetric.com/qscripts/quantum-norton.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.162.16 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:06 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
content-length: 0
content-type: application/json

GET
H3

200

/
www.google.ca/pagead/1p-conversion/1043330685/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1043330685/?random=1447086350&cv=11&fst=1720648386418&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd...
https://www.google.com/pagead/1p-conversion/1043330685/?random=1447086350&cv=11&fst=1720648386418&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag...
https://www.google.ca/pagead/1p-conversion/1043330685/?random=1447086350&cv=11&fst=1720648386418&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_...

42 B
64 B

60ms
60ms

Image
image/gif

142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/1043330685/?random=1447086350&cv=11&fst=1720648386418&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&label=23KzCJj-jYMYEP3sv_ED&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&gtm_ee=1&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CKG4sQIIscGxAgiwwbECCLnBsQIIosWxAkonZXZlbnQtc291cmNlPW5hdmlnYXRpb24tc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&pscrd=IhMIroru3rqdhwMVUF1HAR1_tgWPMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6Fmh0dHBzOi8vdXMubm9ydG9uLmNvbS8&is_vtc=1&cid=CAQSKQDaQooLZeHrCT0vIc3DgrMsJ87hcZxD7HawBTaoRrWRcZDQqjAa6oo4&random=1719333862&ipr=y

Protocol

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/1043330685/?random=1447086350&cv=11&fst=1720648386418&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcs=G111&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&label=23KzCJj-jYMYEP3sv_ED&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&gtm_ee=1&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CKG4sQIIscGxAgiwwbECCLnBsQIIosWxAkonZXZlbnQtc291cmNlPW5hdmlnYXRpb24tc291cmNlLCB0cmlnZ2VyWgMKAQFiBAoCAgM&pscrd=IhMIroru3rqdhwMVUF1HAR1_tgWPMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6Fmh0dHBzOi8vdXMubm9ydG9uLmNvbS8&is_vtc=1&cid=CAQSKQDaQooLZeHrCT0vIc3DgrMsJ87hcZxD7HawBTaoRrWRcZDQqjAa6oo4&random=1719333862&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/1043330685/ 42 B
64 B 57ms
56ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1043330685/?random=1720648386410&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLoM2iEwKS2aJcvqLtQEegXVP-cLmn4SmpnPWopRCMApZ31Qlp&random=3792356061&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/1043330685/ 42 B
64 B 56ms
56ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/1043330685/?random=1720648386410&cv=11&fst=1720645200000&bg=ffffff&guid=ON&async=1&gtm=45be4730v878412864za200zb9166610413&gcd=13t3t3t3t5&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&hn=www.googleadservices.com&frm=0&tiba=The%20toll%20of%20a%20phishing%20scam%20on%20a%20small%20business%20owner&npa=0&pscdl=noapi&auid=493245650.1720648384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLoM2iEwKS2aJcvqLtQEegXVP-cLmn4SmpnPWopRCMApZ31Qlp&random=3792356061&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 norton
ingest.quantummetric.com/horizon/ Frame E7BF 0
0 191ms
188ms Fetch
application/json 34.134.162.16
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ingest.quantummetric.com/horizon/norton?T=B&u=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&t=1720648383896&v=1720648386576&H=c2028f6673bd1ec2effc56a2&s=48be5c7ecae2f98573ec67f274f64da2&S=97065&N=137&P=1&z=1

Requested by

Host: cdn.quantummetric.com
URL: https://cdn.quantummetric.com/qscripts/quantum-norton.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.162.16 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:06 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
content-length: 0
content-type: application/json

POST
H2 200 mon Show response
bite.australiarevival.com/ 0
39 B 50ms
49ms XHR
application/json 50.16.211.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bite.australiarevival.com/mon
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-211-97.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:07 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 mon Show response
bite.australiarevival.com/ 0
16 B 52ms
50ms XHR
application/json 50.16.211.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bite.australiarevival.com/mon
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-211-97.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:07 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H2 200 /
www.ojrq.net/p/ 50 B
457 B 392ms
50ms Image
image/gif 34.95.127.121
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.ojrq.net/p/?return=&cid=4405&tpsync=no&auth=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.127.121 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 121.127.95.34.bc.googleusercontent.com
Software: /
Resource Hash: ec34cd386427fe6deacf99f4fdbeea4b1d1ed25f505411650d7ceaa843a7fc63

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:08 GMT
via: 1.1 google
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50
expires: Wed, 10 Jul 2024 21:53:08 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
194 B 124ms
123ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 10 Jul 2024 21:53:07 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 21BDC1BE3CBA4F92BFA3161A0A5A0AA7 Ref B: YTO01EDGE0809 Ref C: 2024-07-10T21:53:07Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://us.norton.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYc66vzSCSu8ewJHvpGrg==

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/b/ 0
106 B 45ms
42ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/b/r.rnc?n=4&c=21&i=4o5w0e&p=aemprod&s=6804&d=8G57InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxLCJwdWJsaXNoUGF0aCI6ImFlbXByb2QiLCJpbnN0YW5jZUlkIjoiNG81dzBlIiwicGFja2V0Ijo0LCJtb2RlIjoiZW5mb3JjZVgA8ixvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IlVTIE5vcnRvbiIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdLYA8EZodHRwczovL2Nvbm5lY3QuZmFjZWJvb2submV0L2VuX1VTL2ZiZXZlbnRzLmpzIiwidHlwZSI6InNjcmlwdCIsInN0YXJ0IjoxNzIwNjQ4MzgzODA2jAAmZCIUALA1NTcyLCJzb3VyYzwAMW11dH8AsU9ic2VydmVyQ0wiSAChdHVzIjoibG9hZLQAQGFzb26zANRdLCJkYXRhUGF0dGVyEgCxbGlzdCI6W10sImlqAN8xODc3NDMxMDU1OH0s5QAacHNpZ25hbHMCAfEkZmlnLzIwMTA3ODc2MTkxNjQ3MTY_dj0yLjkuMTYxJnI9c3RhYmxlJmRvbWFpbj11cy5uYwHwSC5jb20maG1lPWU2N2U3ZDE0ODA0M2IzYTM3N2FkMGViMWM4MjY2OTc5MmE2N2JhNWUzYmI1NzM0YjY5ZTYxMWFlMzhmOTM5Y2EmZXhfbT02OCUyQzExNQYAITAyBgDwBTYlMkM1OSUyQzMlMkM5NSUyQzY3GQAACgAQOSMAEDgKABA0IgAQNQ8AIDE2KQAgMTY4ADAxNzgrACE3NAYAACgAIDE3PQAQMhcAEDkiAFM1MSUyQyAAABAAIDE1GwAgMTYXACIxNwYAAVYAEDdhACAxMkoAEDMLABEzZgARMzQAABUAETQ4ABA4CwAhMTgcABEyHAAAbwARMxwAQCUyQzRRAAGgABA2KQAQNpIAEDZOABA4BQARMTEAADwAEDkoABA4NgAQOEAAIDEwFQAgNTDGABAwNAASMxYAAEQAEDI6ABAyFQARMSYBITE2rwABnwASMicAADcAAFEAEDEaAAAqAABoAAHKABAyFwARMhcAARgAAGIAAUAAEDcUABA5PwABxgAQN4AAAI8AABIAAUIBETREAAAwABA5gQAQOR0AITEwEAAALAAAFAARMQUAABkAEDhOABA1rgAQOCIAEDMPAAFcAQAOABA5BQAQM4kAAWMBAUIBEDSOABE0MQAATgABZgEBDgAAdgAB1AEQNEQAETMUAAA7AAEOAAA1AAG5ARA0UwAgMTAZABA0QAAQNzcAAhECEDDCAAHkARA1CgAQMyoAEDlHABA1JAAQNS4AEDQZABA3TQAQNx4AEDIUAD8xMDgBBBBNNTU3MQEEPzYzOQEETL8yMjI3NDQzMjYyNwEEB_ADc3AuYW5hbHl0aWNzLnlhaG9vuwPwCS9zcC5wbD9hPTEwMDAwJmQ9V2VkJTJDJQsEsCUyMEp1bCUyMDIwLQKwMDIxJTNBNTMlM0GEAvAGMEdNVCZuPTdkJmI9VGhlJTIwdG9sLgDzDm9mJTIwYSUyMHBoaXNoaW5nJTIwc2NhbSUyMG9uGwAxc21hLACAYnVzaW5lc3McAPECd25lciYueXA9MTE1NDgmZj2gBZklM0ElMkYlMkZyBPACJTJGYmxvZyUyRm9ubGluZS1hABBzFgADUQAgLW9PABQtgwDwKS1zdG9yeSZlbmM9VVRGLTgmeXY9MS4xNi4wJnRhZ21ncj1ndG0lMkNhZG9iZSUyQ2Vuc2lnaHRlQgYD9gUyaW1nqwUYcvMFTTU0NzTyAT85MTHyAUy_MTkxMTEzMzc4MDbyAQcBuwahLmhhdmFzZWRnZe8BYXRyYWNrLRoA8KY_ZW1ldGE9ZXlKd0lqb2lhSFIwY0hNNkx5OTFjeTV1YjNKMGIyNHVZMjl0TDJKc2IyY3ZiMjVzYVc1bExYTmpZVzF6TDJKMWMybHVaWE56TFc5M2JtVnlMWEJvYVhOb2FXNW5MWE4wYjNKNUlpd2lieUk2SW1oMGRIQnpPaTh2ZFhNdWJtOXlkRzl1TG1OdmJTSXNJbUZ2SWpwYlhTd2ljR0Z5YlhNaU9udDlMQ0p3Y2lJNklpJADwB2x1WmlJNlptRnNjMlVzSW14amEybGvEAPBYTWpSaE0ySXlZMll0WVdaa01DMHpNMlkyTFRFd1kySXRZMlJpTm1KallUVXlZbVZqWHpFM01qQTJORGd6T0RRaUxDSnpiM1Z5WTJVaU9pSklZWFpoYzBWa1oyVXVSWFpsYm5SVVlXYygA8BRpZENJNk1UY3lNRFkwT0RNNE5EUTROU3dpWW5vaU9qUXlNQ8QAIHhu0ADwAElsQkVSaUJXYVdWM1pYSUAA_RhEYUhKdmJXVWdVRVJHSUZacFpYZGxjaUlzSWtOb2NtOXRhWFZ0SUY4APASTmFXTnliM052Wm5RZ1JXUm5aU0JRUkVZZ1ZtbGxkMlZ5bAHyBVYyVmlTMmwwSUdKMWFXeDBMV2x1TAAgSmRMATBiSFHgAPABTWFXNTFlQ0I0T0RaZk5qUZgA8BpqYXlJNmRISjFaU3dpZEhJaU9tWmhiSE5sTENKb0lqb3hNakF3TENKMwwAEk4MACBqWgwB8SVqUjkmdHJrR3VpZD0wZDI0ZDM2Mi05MTMzLTRjZjAtOGU3ZS1iZTg3NjJmMDUxMGEmZXZ0LQBANWNmMhsI8AktOWVhOC00MDE0LTk5ZWEtZWM3NzVkMmE6ABAmBwkQLS0KQHVjdF8CCYI9bWlzc2luZxoAim9yZGVyX2lkFgCKc3VidG90YWwWAKZjb3VudHJ5PVVT0wUP3gMDTDQ0ODXeA082MjM43gNMvzIyMDU0NDM3MDQy3gP___9PHzbeAxwSQQMID64NKQbdAx8z3QMH8gc4MTM2NDg3LmZscy5kb3VibGVjbGljmg7jYWN0aXZpdHlpO3NyYz0qABA7pgiAPWxwO2NhdD0bCfQecDA7b3JkPTg1OTEzODAzODg4NTU7bnBhPTA7YXVpZGRjPTQ5MzI0NTY1MC4xwQ7wTDQ7dTEwPXVua25vd247dTE0PWRpcmVjdDt1MTY9dW5kZWZpbmVkO3BzPTE7cGNvcj03Mzg5ODEyOTE7dWFhPTt1YWI9O3VhZnZsPTt1YW1iPTA7dWFtPTt1YXAYACBwdgYA8jR3PTA7cHNjZGw9bm9hcGk7ZnJtPTA7Z3RtPTQ1ZmU0NzMwdjkxNzA4OTE5ODZ6YTIwMDtnY3M9RzExMTtnY2Q9MTN0AgBANTtkbdAA_wd0YWdfZXhwPTA7ZXB2ZXI9Mjt-b3JlQApAFz8wBlJmcmFtZQ4CCREKTTQzNzNVAjczMjczBrNpbnNlcnRCZWZvckIAD1ACKq8xNzAzNjcxOTcwUAL_xB04YQwaNlACD1QSQRQyVgIvODFWAkVSdW5pdmWmBP8CMTtudW09MTkwNzUyMjgyMzerBB8UMeQJD7cEByd1M8QEJ3U5DQAG0QSfMTQ2OTc0MDAy0gT6HzjSBAAIBQsP0gQ7vzE4ODk4NzQ0MTc0fAL_8A_-BAIIfAIP_gRBBYICHzhUBwjxBmJpdGUuYXVzdHJhbGlhcmV2aXZhbGUREW16GACSCW8iOiJ4aHInCAA-NjQwJwgBFAAFKxiyWEhSX01BTkFHRVJBAAImCG9hbGxvd2UnGCCvMjIwOTE2ODkzM3kKCA_VAJ_AMDkxNjg5MzMzfV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:08 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:07 GMT

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/b/ 0
106 B 86ms
85ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/b/r.rnc?n=5&c=21&i=4o5w0e&p=aemprod&s=24367&d=8G57InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxLCJwdWJsaXNoUGF0aCI6ImFlbXByb2QiLCJpbnN0YW5jZUlkIjoiNG81dzBlIiwicGFja2V0Ijo0LCJtb2RlIjoiZW5mb3JjZVgA8ixvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IlVTIE5vcnRvbiIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdLYA8SNodHRwczovL2JpdGUuYXVzdHJhbGlhcmV2aXZhbC5jb20vY3Q_aWQ9MzQ4NzAmdXJsPTIA0SUzQSUyRiUyRnVzLm5nAAAsAPAHJTJGYmxvZyUyRm9ubGluZS1zY2FtcxYA8ht1c2luZXNzLW93bmVyLXBoaXNoaW5nLXN0b3J5JnNmPTAmdHBpPSZjaD21AIImdXZpZD0mdBsAQXNmbWkNAPAjdT0mY2I9MTcyMDY0ODM4NDE3MiZobD0xJm9wPTAmYWc9NTg5OTEzNjUxJnJhbmQ9OTMRAPdQOTEwMjEwNzUxNTAyMTY5OTE3NTkwNTY5MjA5NDExNzg0MDA4ODAxNTUwNjU4MTI2MjIwNjIxNzQ3MDU5MjI5MTEyMTI3MjUxNTA3MDk4JmZzPTE2MDB4MTIwMCZmc3QOAPgbbnA9bGludXglMjB4ODZfNjQmbnY9Z29vZ2xlJTIwaW5jLiZyZWY9JnNzNQAQY7wA8DJ0PSZkaT1XMXNpWldZaUxEUXhNelpkTEZzaVlXSnVZMmdpTERJeFhTeGJMVEV6TENJdElsMHNXeTB5TXl3aUt5SiwA-Ih0TWpVc0lsdGNJbHN6TWpnNE9UVXpNREkyTEdaMWJtTjBhVzl1S0dncGUxZ29aQ3htZFc1amRHbHZiaWdwZTJJb0xUSXpLU2hvS1gwcE8zSmxkSFZ5YmlCbExtRndjR3g1S0hkcGJtUnZkeXhoY21kMWJXVnVkSE1wZlYxY0lpeGNJbHdpTEZ3aVd6UTBNRGsyTlRBeU1TaADyHkIwYjFOMGNtbHVaeWdwSUhzZ1cyNWhkR2wyWlNCamIyUmxYU0I5WFZ3aVhTStQAJHpR1ADfeU16TTFOelE1TVRJNNQAFy9RNNQAAB9u1ABrAKgB8wdzeE56SXdOalE0TXpnME1EUXpMRGRk2AHyDnpOaXdpVzF3aU5DOHpYQ0lzWENJMEx6TmNJbDBpCAInVXgIAhAxCAJDTVRBd0AAgzJNaXdpT0RBLAD5F1FzSWp4b2RHMXNJR05zWVhOelBWd2laVzR0VlZOY0lpQnNZVzVuFADwNmo0OGFHVmhaQ0JqYkdGemN6MWNJbUYwTFdWc1pXMWxiblF0YldGeWEyVnlYQ0klMkJQSE5qY21sd2RDQmhjM2x1WXoxYxICQUlITnkMAPN6bWgwZEhCek9pOHZkMkYyWlM1dmRYUmljbUZwYmk1amIyMHZiWFJYWVhabGMwSjFibVJzWlhJdmFHRnVaR3hsY2k4d01ERm1PVFl4WW1RNVlqQTFNV0V5T0RFNFlqUXdOVGd6TlRObVpHRTVNbUptWENJZ2RIbHdaVDFjSW5SbGVIUXZhbUYyWVioAPAQRndpUGp3dmMyTnlhWEIwUGp4elkzSnBjSFFnYzNKag4B_zBhSFIwY0hNNkx5OWpiMjV1WldOMExtWmhZMlZpYjI5ckxtNWxkQzlsYmw5VlV5OW1ZbVYyWlc1MGN5NXFjMXdgABnzCzNkM2N1WjI5dloyeGxkR0ZuYldGdVlXZGxjHAHzF1ozUmhaeTlxY3o5cFpEMUhMVVpITTAweVJWUXpSVVJjSWo0OEwz3AC8RDQ4YzNSNWJHVWcEATBZM05SAvMqJTJCYUhSdGJDNWxiaTFWVXlBalpXNXpUbTkwYVdaNVFtRnVibVZ5SUNObGJuTkNZVzV1WlhKRVpYYgABOATwDkI3WEc0Z0lDQWdkRzl3T2lCMWJuTmxkRHRjYm4wjgBYMGVXeGxaAQyOAAySAXFJR0Z6ZVc1fgEAwgEPigEA_xhxY3k1aFpITnlkbkl1YjNKbkwzVndYMnh2WVdSbGNpNHhMakV1TUOCAQuwWVhONWJtTTlYQ0oAAyF6YwwAwEl2TDJRdWFXMXdZV6gEgkZrYVhWekxX1gH-LExtTnZiUzlCTWpRM05EVXlMVEUyWldFdE5EWmhNUzFpWmpObExUQmtPV1UwTlRFNFptWTVZekV1YW5OngEDdgJwSUhSNWNHVYgAwzBaWGgwTDJwaGRtRooCEFKcAA9OAwNAaTh2WZAD_wFtSnBibWN1WTI5dEwySmhk-AAMD4ABJT9MeTmiAh3iRVF5MDRNVE0yTkRnM1gkBCNDOdoAGlEyBFAwZVhCbHIDxGRHVjRkQzlxWVhaaJoDAAgCD7ABA_MLSm9kSFJ3Y3pvdkwyRndjQzVzWldGa2MzSjSsAcMyYVhOcGRHOXlMbXD2Ah9QhABHYDNNdWNHbEACE26AAJ9qZEM5amIzSmyAABAP6AEDBzYFollTNXhkVzl5WVMuBRNjmAIPbgQND_QBJQf-BPAEaGJtRnNlWFJwWTNNdWRHbHJkR_4EARAD8gBwTVRodUwzQnBlR1ZzTDIsAwGUAGB6OXpaR3SuBP8cRE5FcFRRVkpLVWpKUk0wOUhNRXBCUlZSR01DWmhiWEE3YkdsaVBYUjBjVpYFGnN6TG5scGJXAAODM2RwTDNsMFl-BQtMBAByAg_8AQUDAAQHUALzBzNkM2R5NXlaV1JrYVhSemRHRjBhV01oA7NGa2N5OXdhWGhsYnADD2wAGA_oAQ7iZDNkM0xuQmhlWEJoYkPsAQoSBmA5d2NIUnRUAvIJUDNROWVHOG1ZVzF3TzJsa1BXNXZjblJ2UgcfMXgEBw9oBQ9Fell5MfgAQGJtVjBeBjBaWFr8B1B1YldsdYAAD9gDDAD8AdBjSW5Ca2MzUXRZMkZ3VApLWlZ3aTABD3IHAvAIWkc0dWNHUnpkQzVtYlM5d2FXNW5MbTEuCA9eBwoPLAQO8QczZGxZbk5rYXk1aGNIQnpabXg1WlhJ3AHyAFAzTjBQV0poYm01bGNuTVgBD8oHCA9sAAMASAbxBkZ0Y0d4cFpua3ViM1YwWW5KaGFXNGQAskwyTndMMjlpZEhBHAYvaUIABQ0PvAIJDzwADR9npAAGAuQC8wZuYjI5bmJHVjBZV2R0WVc1aFoyVnnABBBueAJQTDJwelBcAv8CVUZYTFRFd05qazVNamM1TlR2CAAE2AYPYAIENUx5OVQCxFlXUnpMWFIzYVhSMIABT0wzVjPEBkUH0AQRalwC8gJYVmhiblIxYlcxbGRISnBZeWwDFGPkCERITXZjJAAgUzFsCEIwYjI0tAEMbgkEhA1UVFFzSWmkC6BNd0xDSmJYQ0oyxAslTUYYAKV4TENKbVlXeHpa6AwYSTgAEDPcC-RNVFEwTFRZMkxURTRNQzwAGFH4CxAw6AvTTVRjeU5ESTVOelkxTYgAEE6IAKBudGNJbWhjSWpwhAAyZk1WoA3ATXpJNU9Ua3hNelk1mABvWENKZk0xHAABAIQNcXdpWkZ3aU9YDiI4eDAA8gFJeU1URTFPVGMyTkRrMlhDKAAtWWwoAMB4TkRnMU1UVTVORGeABxFzbAASRmwA4k5ESTRPVGd5T0RjME1sFADTTVRnNU5qRXdOVEV6TygAsE9ERTVOVGsyTVRoAA0ARAAATAA0Nk1YFAHx_8NVM0xDSlhSVEJhVmpGNFQyTldhRmhZVmxaalUzaGpSbGRzV2xWVFZYaE9XRVl3U0VkWFNsbFRhR3haVTFWc1ZsRkhVVnBGVm5oUVYwWlZXbGRGTUZwQ1ZtaFlWbXhrUVZaR1drMVRaMk5hUlZGTlQwRjNaMDFEVVc5S1FWSkJWa2RSVmxsV01WcFlVVVpTVjFSRmIwaEJkMmRDUVhkdlNrVkNWbGxVVW13MFV6QjBXVkZDWkdaWVFtdFNWVlV4VGxOVmIwUkdhRnBMVTFaQ1pGaEZjMWhYUlhoTFZGVjBXVlpXUWxsVE1YaFFWVVU1V1ZaU1pHRldiRkZYVlVKWlFsaFJhMEpYZDJoaFdIZG5URmQzT1dSWVJqRmtSRkU1WVVSM1JVcFhkelZrUTBaNFlWZEJRVWxEUW1SVVUyZE5TVUYzT0U5RVFXdExSVUpXV1ZSU2JFeEhVa1pTVkZVeFNsTm5UVmRHYTNCS1ZVWXhZMU40WkZsVVJYQk9VekZvVmxWR2FFeFlSVGxSVkRGb1ZrWXhjRmRXUWxwUlJtZEdaRU5SUm1KRFJuQm1RMEYwWWtReE1XTllWakJPUkRGdlVFRlJiR0pFYkRCSldFRTlQU0r8D4JOakFzTVRVNPAOEVkUAwTgDvUeT1N3aVRHbHVkWGdnZURnMlh6WTBmRWR2YjJkc1pTQkpibU11ZkRoOE1UWjhmCA_zfklzSWpFd0xHVkJTRmRZTVM5bU0zRjZRM1ppYTNWNWJWRjNaMnhKWVVZemNFVnpVa1ZGVkhCdlZtUkdWa0pSVVhCU1kxSkNSbE5MU1VsbmFWSkpjakJMYUVwU2NYQlRRWFJEUVd0UlNIQkplbmxpWWxod2JWcHlMelV2WkRrMllucGpkVk5CVUVvdlIzUZwPF2P4A6NFeUxDSnVkV3hz6AAweE9DUBGUQXNNQ3d3TERGIBARMPAPQURBd00EACBFd_wPAQwAkFRBd01URXhNRAQAE0EIABRFKAADdABUUTJMQ0ksEBAxZAATTIgEIE5qcBEgc3fIEQDsAzRXMTF0ABAylBDxIVoyVnZiRzlqWVhScGIyNHNjM1J2Y21GblpXRmpZMlZ6Y3l4bllXMWxjR0ZrTEdObzIP8BhHMXBaR2tzWkdsemNHeGhlV05oY0hSMWNtVXNkWE5pTEdKeWIzZHrgBwBIDqBhV056TEhCcFkzJABEVnBibgwA8AZVc2NIVmliR2xqYTJWNVkzSmxaR1aQCpFoYkhOblpYUXOcAFBXeG1iMoYPoHh2ZEhCamNtVmuWD_AZYVdGc2N5eGxibU55ZVhCMFpXUnRaV1JwWVN4amFITmhkbVZrWVhSaLgAQGRXRm2IAfAgZG1WeWMybHZibXhwYzNRc1kyaDFZWGR2ZHpZMExITm9ZWEpsWkhOMGIzSmhaMlUgAGBrYjNkdWIIDBB5WADgQnlaV1psY25OamIyeHYIAHFhR1Z0WlN46A5DZUdoeXAAEHQAEyliQzQAAIAK0DFZMlZrZEhKaGJuTndwAMBibU41TEhObGNtbGgwAAFwASBtRXwAkHdjbVZtWlhKevQAgmRXTmxaRzF25BPyFnh3Y21sMllYUmxjM1JoZEdWMGIydGxibWx6YzNWaGJtTmxMR2woAS9YUlwBAgH8AHBXWjFiR3gyZAAAUBQBiBMRRzoRQGxaVzSEALBrY0hJc2RXNXNiMgQC43RsZVdKdllYSmtiV0Z37ADwAXdiR0YwWm05eWJTeHphR0boABB6qA0B8hAQMmQS8RhOMGRYSnNMR2Q1Y205elkyOXdaU3hwYm5SbGNtVnpkR052YUc5eWQwAcNWaGJXOWlhV3hsTEikFCAyMbQME26sEgCYAPoBMVlTeHdkV0pzYVdOclpYbBgC8AcyTnlaV0YwWlN4dFlXZHVaWFJ2YldWmAjgc1lXTmpaV3hsY205dFpAAR9pTAEEEW6QAjJ0Y0gcAwIwAbFGeVkyZ3NlSEp6Y0QMIEZzzAEwWTJ0uA8CmABwV1p2Y20xbXQQQGIzSnqIAUBiR1ZrbAAnWTNMALVYQnNZWFJtYjNKdJgCEGkwAvEJZHBaSFJvTEdOc2FYQmliMkZ5WkhKbFlXsAJgMmFXVjNjLAEVSCgAgHZiWEIxZEdWMAIAAAKQeVpTeHdZWGx0KAMBpAFgbWxsZDNCTAxxb1pXbG5hSEwAIHlkCABQWFYwYjOMAPAGa3NZM0p2YzNOdmNtbG5hVzVwYzI5pABibFpDeG9hgADQMVlXSnBkRzVsYzNNc9QP8A5aV1Z1ZDJGclpXeHZZMnNzY0hKcGRtRjBaV0ZuWtQDEDJsDSo5ddAAoWR5YVhSbExHRjCsCSFuVtAWgGNtVndiM0owPAQAuADxBVpHVjJhV05sYldWdGIzSjVMRzFwpABjR2h2Ym1VAAUgWTRgCQNkBTB5TnlkBaBVd0xERXdMREFzbBUQWhAJIEc17AIEAAUQeXQGBigFMEVzSWAJ8BJuZG5jMnhjSWpwY0lqUTdjbVZoWkc5dWJIbGZZVzVrWDOIAYBSM2NtbDBaVvwKIDl55AIgWDOSFAHgBPAHek8zQmhZMnRsWkY4MGVEaGZhVzUwWvoT8AdsOWtiM1JmY0hKdlpIVmpkRHQxYm5KwANAeWFXTsAEQmZjRzkUAyBsORwEEmi0AhBKVAARdkgAMFhKZhwSQGNHOXpAASNYMqgFMXp0Y7QXQW5Calq4CbB3aVltZHlZVGgxYpgDQ1Z3aWYUBgBsBgCMFgNQAPMDdVlXd3RjR1JtTFhacFpYZGxjvAkPIABpBDAY8ARORGNzSWtGdFpYSnBZMkV2Vm1GdA0QMTAD8gFMR1Z1TFVkQ0xHeGhkRzRzbAIzOXll6AD0AE5Ua3NJbVJsWm1GMWJIUSwCBOgBAOQBRWJYQ0kECwT4ChFiQAEgdGQ0BwMsCxVkPAEnakXgB6FNNExDSmpMQzB4BAARRNgHQ3hOREXgBxBF0BnBeE16QXNMVEVzTkRNAAnzDE1TNDNMREUxT0RFdU55d3lNakF3TERJeU1ERaQAIFEw0AcAvAJDTUN3MdgCUzVMQ0lyDACheE1Td2llMXdpZMwLIHdp3AeAWENKdFhDSTbcATNaR1aaEwBwBBI1HAKzbTluT25ScGRHeGwwAFl2WnpwawQWA_wB8AFkSGRwZEhSbGNqcDBhWFJz5A8AEAEHGAANOAAVWMALJ0UxkAMQeGgDaFd6Y3dMRAQAAiwBQUxESTAEAAAcDADQDEBERTJNSAGBVEl3TUN3eE4cASJFeRQAEVkUAFpNamcxTCgAAegDAVQJBEgABAgACCgABbAN0kkyTENKN1hDSjBhbWh8DBBq1AxQTXhOVEWQDBUxGAAwVGcxeBswT0RjGABAcWFITlAEETagDSBEY9gMNDFNbrgMEFGIBACMAAPIARBZ3BsEmAkQeHAJEU1cDTFzdE2YCaB0Y0luTmxibVJDcAkgYjKoAQAYCmZFc01Td3gEAxdVdAIQUQgCBDAcEDFUABBiUhn0A0hOallYQmxMWEJ5YVcxaGNua4QACIwBCAwAAKwABEgAEXqkATAxd2mMAiBNemgKYGRjSWl3efQBclIyVmphMjlEAkNrNWxkbAADRAKQTmIzcHBiR3hoEABxYm5Wc2JDePQKs0xIUnlkV1VzT0N4HA8DGAAgRFU0B6ExWlN4MGNuVmxMmAVDd3NNQxAAATgAI1Zk7AKDME1Dd2lNek3QABBVxAAReBwAIHpNKA74AGJNek14TmpJeU5EQTBPU6Ac8ANodVpYZFdZV3gxWlNrZ2UxeHXcGAoEAGBCaFpHUkRgCgAsB_EMVjJsdVpHOTNVSEp2ZUhrb2RHaHBjeWxjYmlBGBkIPADATHk4Z1VtVnpaWFFn1AXwAWNHVnlkSGtzSUhSb1pTQm9SGlFJR2x6SUAGUGtnYm1W4AoQaxAAP1kyVlQAAkFUMkpxZAsBuAT_Gmx1WlZCeWIzQmxjblI1S0dsbWNtRnRaU3dnSjNOeVkyUnZZeWNzSUh0TAACEEnsG_ADMjVtYVdkMWNtRmliR1U2SUdaXAs_bExGDAEBQUFnSUiYB4RoWW14bE9pQrgBD2AABREyXAFEVG9nWJAAD2QBAz85S1ZwAAFgQmZhV1p58AokTG7QAIBBOUlHNWxkMagAJFZskBoGeAEkQjkYAzdNakEYAxBJbA0AGBEQdYgCQFhDSnXQBQEoAjB5MDFEAgPsBxB4ZBEAPAVAWTNSNDAFkFhDSjNaV0puYjQEQUZ3aWQABiF3aQAHg1d3Z2FXNWpMGAUAHAcnT2wcAPADWEpwY3lCdmNHVnVaMndnWlc1OAkEYAVAemJIWmgG4GNJbmRsWW1kc0lHZHNjKACmWE1nTVM0d0lDaDwA8xBYTWdaMnh6YkNCbGN5QXhMakFnWTJoeWIyMXBkVzBw2AAQbvwGCbgAEkMsAEBLRzl3gAADQAAfeUAACAAkARM2-AAwcmFYmBpheGNJbUps_AYgamvsBAA8D1BjSWpveAQEAFwHARwA0mx3aWQyVmlhMmwwSUjUAAOYADB6WlfsAKBveE9UTXdPREl3VBQAPABDYzJWarAAI2NJLAUkSW0IIUFFMk9G_CAICBMXeLABQHRNVGPoDxMyzAEQeeAOAuweU01zWlc0GAQjTXqcE9FiTlRNNU16VTRORE0z0AwPLCESJVEzWCAwMXhjmAkA3BZPYmlCbVwgaSZOVEgUYEltUmtZafQQAEgRAUAHEHkkCCBOaTQGARAAAHwGA3wIEEFEBgIQAB1TIAAQeDgAATAHAGwHAYwQAUAAAhgADDAAARAAGElYAAIoAAY4AAJoACJDdxgAJlRjfAAJJAAC4AiPSW1OaUlpd2mAAAACSAABcAAA5AAESAkBnAACHAAJUAAPGAAAE1OEAA8oAA0PIAANBIQADygACgGgAB8xTAEEgHdJbDFkJmRlziT2PHByZT0wJnNkZD0lN0IlN0QmY3JpPTF6MDBsZFN0NUgmcHRvPTIyMjcmdmVyPTYxJmdhYz0tJm1laT0mYXA9JmZlPTEmZHVpZD0xLjEl_QQuelNraGlZeDBQejB2VHBzdSZzIwD9AzBOR3RnaFB0OTc0WDFPM3AmdCMA8AQ2Q0V0Y1RtSllZcW5EU1F0JmZifQBwZ3RtPVd5SighBR4Q8ApJbDAlM0QmaXQ9NzUlMkMxODEyJTJDMjAzNAAwbD0tuAADBwCAc2Q9LSZydGlLACBiZwYAoHNwYT0xJnVyaWQjJfYjYj0mc2NrPS0maW89YUdBMk9nJTNEJTNEIiwidHlwZSI6InNjcmlwdCIsInN0YXJ0Ijr5ADAxNzciJxdkFACwNjQyNiwic291cmM8ALJhcHBlbmRDaGlsZEEAkHR1cyI6ImxvYRAAYHJlYXNvbkIn1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWMAzzI1NDIwODAzMDl9LHQn____________________________________________________DD8yNTl0JwwxbXV0iU6vT2JzZXJ2ZXJDTHsnOC85MXsnCHBhdC5iaW5ntk4wL2FjDU_wri8wP3RpPTE4NzAxMDU3NyZWZXI9MiZtaWQ9ZGY3NTFjMTctNzYxMC00MTc1LTk1NTEtYTlmMzgxNDBmNWZhJnNpZD1jOGRmMmE5MDNmMDYxMWVmYTRjNWNmMTc1YWNhMmQwZSZ2aWQ9YzhkZjM2OTAzZjA2MTFlZmExM2EyMTAxMWM2OGU5Yzgmdmlkcz0wJm1zY2xraWQ9TiZwaT05MTg2Mzk4MzEmbGc9ZW4tQ0Emc3c9MTYwMCZzaD0xMggAoGM9MjQmdGw9VGhtTvQBdG9sbCUyMG9mJTIwYSUyMHRPMCUyMJZPABsAE24bADFzbWEsABNipk8AHAAAqE8vJnDtT0D2IHI9Jmx0PTE4NDYmZXZ0PXBhZ2VMb2FkJnN2PTEmY2RiPUFRQUEmcm49ODIxMDkx3CkyaW1nHQIJ2SlONjQzNWUCABQABdkp8gdIVE1MSW1hZ2VfU0VUQVRUUklCVVRFTAAC5ClvYWxsb3dl5ykinzIwNTY4MDQ5MmwCtPwRZWM9Q0hFUSZlbD1JbnZhbGlkX1VzZXJzJmV2PTAmZWEWAD9uPVknAkIfc94CAgAyAmljdXN0b20rAl85Mzk5MSsCEQ8ELAAnMzcELA8rAkhgMTg5NTExilIfNisCFGZiYXQuanMBAw_dLAZPNjQwOAQDABc52QDIaW5zZXJ0QmVmb3Jl-gIP3iwkrzA0OTUwMjk0NzDMAD8vMjTMAAwPNQZCBNIAHzieAQjwGmNvbm5lY3QuZmFjZWJvb2submV0L3NpZ25hbHMvY29uZmlnLzIwNTM5XVT5EzQ4Mzc5ODA_dj0yLjkuMTYxJnI9c3RhYmxlJmRvbWFpbj07VfA-JmhtZT1lNjdlN2QxNDgwNDNiM2EzNzdhZDBlYjFjODI2Njk3OTJhNjdiYTVlM2JiNTczNGI2OWU2MTFhZTM4ZjkzOWNhJmV4X209NjhoLxExbi8QMG0v8AExMDYlMkM1OSUyQzMlMkM5GgAgNjclAAAKABA5IwAQOAoAEDQiABA1DwAgMTYpACAxNjgAMDE3OCsAITc0BgAAKAAgMTc9ABAyFwAQOSIAUzUxJTJDIAAAEAAgMTUbACAxNhcAIjE3BgABVgAQN2EAIDEySgAQMwsAETNmABEzNAAAFQARNDgAEDgLACExOBwAETIcAABvABEzHABAJTJDNFEAAaAAEDYpABA2kgAQNk4AEDgFABExMQAAPAAQOSgAEDg2ABA4QAAgMTAVACA1MMYAEDA0ABIzFgAARAAQMjoAEDIVABExJgEhMTavAAGfABIyJwAANwAAUQABvjAAKgAAaAABygAQMhcAEDIxABE1GAAAYgABQAAQNxQAEDk_AAHGABA3gAAAjwAAEgABQgERNEQAADAAEDmBABA5HQAhMTAQAAAsAAAUABExBQAAGQAQOE4AEDWuABA4IgAQMw8AAVwBAA4AEDkFABAziQABYwEBQgEQNI4AETQxAABOAAFmAQEOAAB2AAHUARA0RAARMxQAADsAAQ4AADUAAbkBEDRTACAxMBkAEDRAABA3NwACEQIQMMIAAeQBEDUKABAzKgAQOUcAEDUkABA1LgAQNBkAAfExEDceABAyFAAgMTDIABExrAASMa0BAaQBETFFAhExKgESMQUBAU4AIDE4TwASMZgBAocBAWIBETGtAhIx1gEC8AEBugISMSMCAa4AETElARExlwERMgYAITEwSwEQMo8AEzG0AQGWAAHEACExMQwAAQkCIDExvQA_MTQ2ewUmLzU4ewVIjzIzODY3NTQyqQT_____IQ9YCQEAoQ8FKA0PWAlDwDIzODY3NTQ0Mn1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:08 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:07 GMT

GET
H2 204 r.rnc
ensighten.norton.com/privacy/v1/b/ 0
106 B 89ms
88ms Image
text/plain 3.233.164.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ensighten.norton.com/privacy/v1/b/r.rnc?n=6&c=21&i=4o5w0e&p=aemprod&s=7454&d=8G57InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjc0IiwiY2xpZW50SWQiOjIxLCJwdWJsaXNoUGF0aCI6ImFlbXByb2QiLCJpbnN0YW5jZUlkIjoiNG81dzBlIiwicGFja2V0Ijo0LCJtb2RlIjoiZW5mb3JjZVgA8ixvb2tpZXMiOnt9LCJlbnZpcm9ubWVudCI6IlVTIE5vcnRvbiIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdLYA8xxodHRwczovL3d3dy5nb29nbGVhZHNlcnZpY2VzLmNvbS9wYWdlYWQvY29u6wD7HC8xMDQzMzMwNjg1Lz9yYW5kb209MTcyMDY0ODM4NjQxOCZjdj0xMSZmc3QYAEFiZz1mAQDyOiZndWlkPU9OJmFzeW5jPTEmZ3RtPTQ1YmU0NzMwdjg3ODQxMjg2NHphMjAwemI5MTY2NjEwNDEzJmdjcz1HMTExJmdjZD0xM3QCAPAKNSZkbWE9MCZ0YWdfZXhwPTAmdV93PTE2MAkAQGg9MTIJADFybD3sANElM0ElMkYlMkZ1cy5uIQEA5wDwByUyRmJsb2clMkZvbmxpbmUtc2NhbXMWAP8sdXNpbmVzcy1vd25lci1waGlzaGluZy1zdG9yeSZsYWJlbD0yM0t6Q0pqLWpZTVlFUDNzdl9FRCZobj1UAQVAJmZyba8A9AtpYmE9VGhlJTIwdG9sbCUyMG9mJTIwYSUyMGcAMCUyMIkAABsAE24bADFzbWEsABNimQAAHAAAmwAARAGAX2VlPTEmbnANAdBwc2NkbD1ub2FwaSZhbwGlNDkzMjQ1NjUwLq4BoDQmdWFhPSZ1YWIFADBmdmwHACBtYkEBIGFtDAARcAUAEHYGAPYQdz0wJmZkcj1RQSZjYXBpPTEmZGF0YT1ldmVudCUzRCACgCZyZm10PTMmBgAA_AL1CHR5cGUiOiJzY3JpcHQiLCJzdGFydCI6hQBANjQyML0CGWQUAJA4NSwic291cmM8ALJhcHBlbmRDaGlsZEEAkHR1cyI6ImxvYRAAYHJlYXNvbt0CMF0sIpUAZFBhdHRlchIAs2xpc3QiOltdLCJpYwC_MTE4NDkwMjcyfSwPA___hB81DwMMMW11dL8FIE9iqgVPZXJDTBYDOR83FgMHBSEG9AMuZy5kb3VibGVjbGljay5uZXQoBrZ2aWV3dGhyb3VnaBMEDzMGDR8wMwYELzAmMwYxH2QqBnEPDwZeDwYGTgBqBQX_Bb9ndGFnLmNvbmZpZwAGHy4xNvECLzk0AAZGrzE0MzE4MDI5NDDqAv__YC8yNOoCDA_bBUIF8QIfOPECBwCsCv8QY2xhcml0eS5tcy90YWcvdWV0LzE4NzAxMDU3NyIsIskJDy85N98AABc4yQPIaW5zZXJ0QmVmb3JltAZqYmxvY2tlzQlhIldoaXRlvgkP2AkJCicAA-MJrzIyOTk2MzIzNjbyAAdwYmF0LmJpbrcEYG0vcC9hYxINBvEAPy5qc_QAEi8zM_QADA-9CjufMTQyOTU2OTE2vQQID9oANR842gAMD60CRAPhAB81uwEUA7kBVTA_dGk9rwLySCZWZXI9MiZtaWQ9ZGY3NTFjMTctNzYxMC00MTc1LTk1NTEtYTlmMzgxNDBmNWZhJnNpZD1jOGRmMmE5MDNmMDYxMWVmYTRjNWNmMTc1YWNhMmQwZSZ2aSUAJzM2JQDzKTEzYTIxMDExYzY4ZTljOCZ2aWRzPTAmbXNjbGtpZD1OJnBpPTkxODYzOTgzMSZsZz1lbi1DQSZzoQ4Tc6AOj3NjPTI0JnRsEQ44H3DxDkDwAHI9Jmx0PTE4NDYmZXZ0PR0Q9g1Mb2FkJnN2PTEmY2RiPUFRQUEmcm49ODIxMDkxQgMyaW1n8QML_A0eM2UCEDVTAwX8DQxlAhJBRwACAg5RZXJyb3LhEA8DDhufMjIwNTY4MDQ5ZQK1_BFlYz1DSEVRJmVsPUludmFsaWRfVXNlcnMmZXY9MCZlYRYAT249WSYgAkEP1wIDACsCaWN1c3RvbSQCXzkzOTkxJAIlCCAKDyQCQa8xODk1MTExMDIxEQ0IADYHBRUNDzYTFw83EggEGhMCLxEQPVEUA3gHD0IDBS0wOacFNzY5OXUHD4EGO58yMzk0NTYxNTGBBggPFwFxD2sJAAoXAQw1Ag9GDzIEHgEfMlkECfAFaXRlLmF1c3RyYWxpYXJldml2YWyFFCEvba4VA_ABIHho2gQMLhM9NzQwRAoCFAAFMgW4WEhSX01BTkFHRVIsBVthbGxvd2QJD1kJCQYxE0AyMDkx8wYvMzSTBwgP1QAsDfQQODc0MAMUD9UARw-qAUgN2A5HNzQwNpoDD9UARw_4CgkPqgEsD9UAgtJ3YXZlLm91dGJyYWluTAPyAXRXYXZlc0J1bmRsZXIvaGEIAPYTMDAxZjk2MWJkOWIwNTFhMjgxOGI0MDU4MzUzZmRhOTJiZrQIAoQFAkQDCbcIPjM5N4UDNzYzN9sBD-oMBQ-0FiSvMTczNzY4NTA0M4MDBw8EAV4OtAMKBAEPYgVCBQoBD40ECNNweC5hZHMubGlua2VkEAI2d2Ev2gEPXAUELTkyjgoRNxQAD1wFR58wNjkyMjkwNDJPBwgPzwAnDRsIODc5MhsID4EEPtAwNjkyMjkwNDIxfV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.233.164.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-164-149.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:08 GMT
cache-control: no-cache, no-store
server: nginx
expires: Wed, 10 Jul 2024 21:53:07 GMT

GET
H2 200 main-v2_f01faeed4f261176a71666567394c61a.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 499 KB
109 KB 34ms
33ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main-v2_f01faeed4f261176a71666567394c61a.br.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 9f9e72467e556b193d96c4a3cf06cf82ea3ac7d2dc87431b1bbfbde5f0ea9b76

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 20:07:42 GMT
content-encoding: br
age: 6326
x-guploader-uploadid: ACJd0Nprdte0Y1syMf0D8vvaNGfzTMN2E39iyOOBrQGeeiuZ9rh_Em6utVdSj6FlOCDAUSGwRGU
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111559
last-modified: Wed, 10 Jul 2024 20:07:33 GMT
server: UploadServer
etag: "ec2154a211aad04436477a35f412d033"
x-goog-generation: 1720642053346262
ad-auction-allowed: true
access-control-allow-origin: *
x-goog-hash: crc32c=Y9fkEw==, md5=7CFUohGq0EQ2R3o19BLQMw==
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 111559
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 cjs_min_3a843477d8e318f67237a66d0a58c542.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 49 KB
16 KB 25ms
25ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/cjs_min_3a843477d8e318f67237a66d0a58c542.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 6c58f061a49641f54723faab57ad0bdb49a95619e86c90dad9a3ed630ffb3780

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 07 Jul 2024 23:07:58 GMT
content-encoding: gzip
age: 254710
x-guploader-uploadid: ACJd0Nrqd4haxtAK4t-fCMCNdrTEbO8Bv2GL-LCRo6gHi3JmSIl39_xl0KRNJAyDkDJF4NttXMiipSsYkQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15748
last-modified: Mon, 22 Apr 2024 20:59:52 GMT
server: UploadServer
etag: "1eb885454ea6bef1c9747800702959de"
x-goog-generation: 1713819592631797
ad-auction-allowed: true
access-control-allow-origin: *
x-goog-hash: crc32c=Joap5g==, md5=HriFRU6mvvHJdHgAcClZ3g==
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000,no-transform
x-goog-stored-content-length: 15748
accept-ranges: bytes
content-type: text/javascript; charset=utf-8

GET
H/1.1 200
OK / Show response
data.cdnbasket.net/ 14 B
338 B 108ms
50ms XHR
application/json 34.95.102.126
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.cdnbasket.net/
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.102.126 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 126.102.95.34.bc.googleusercontent.com
Software: /
Resource Hash: 1f90ca8a1ad6076855d571ddee36406012190b1d885dbcadebc56ebd26040afa

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 10 Jul 2024 21:53:08 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
page.cdnbasket.net/ 14 B
338 B 107ms
48ms XHR
application/json 34.149.159.242
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://page.cdnbasket.net/
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.159.242 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 242.159.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 3cc8817fa850356fa615fd4cf59f2f5581f4e4bc5e62507dd1fe340c7c44467d

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 10 Jul 2024 21:53:08 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H/1.1 200
OK / Show response
view.cdnbasket.net/ 14 B
338 B 106ms
49ms XHR
application/json 130.211.45.18
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://view.cdnbasket.net/
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.45.18 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 18.45.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 7324a3ebec2bcf828678d3b558adb00f3ac679bd101d43b2d6b8f29a5c60c9b9

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 10 Jul 2024 21:53:08 GMT
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Access-Control-Allow-Headers: Origin, Content-Type, Accept
Expires: 0

GET
H3 200 inbox-v2_02aca5df0e176b8810a86da97ac05424.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 17 KB
5 KB 27ms
27ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/inbox-v2_02aca5df0e176b8810a86da97ac05424.br.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 03dbf9dc05fa84370cbdfb363a10855e9fd035a833cd83b67e14cdb975882bed

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 03 Jul 2024 20:27:50 GMT
content-encoding: br
age: 609918
x-guploader-uploadid: ACJd0Notl670aeblbBUXcvYpminFrg0bjUFkSLxVnGrkBgDnRd6-A-mJNUoctkBiVubiqLKyBac9m2EKyA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5089
last-modified: Mon, 01 Jul 2024 15:41:49 GMT
server: UploadServer
etag: "2a4c802d3ec2dfc292cc9bb15ef5f45d"
x-goog-generation: 1717444355855996
ad-auction-allowed: true
access-control-allow-origin: *
x-goog-hash: crc32c=PRHjLA==, md5=KkyALT7C38KSzJuxXvX0XQ==
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 5089
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 onsite-v2_0e56ab6ba004ee080ce3deb3edae35e9.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 16 KB
5 KB 27ms
26ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/onsite-v2_0e56ab6ba004ee080ce3deb3edae35e9.br.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f10699f59e4285b87af5097e4ba9e470ee29b4f3487fa767f2818bdbbdd6bb14

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 25 Jun 2024 03:41:48 GMT
content-encoding: br
age: 1361480
x-guploader-uploadid: ACJd0NrzgbC4hD_eTIiB0YLIqkknZf7NTevJWRst0alq3alABfq1e4Bn-48nES1cS48zj_LUOKE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5003
last-modified: Thu, 20 Jun 2024 14:04:58 GMT
server: UploadServer
etag: "7ff99b6f1cea743cef749de91009e764"
x-goog-generation: 1713883044855037
ad-auction-allowed: true
access-control-allow-origin: *
x-goog-hash: crc32c=qFvE1Q==, md5=f/mbbxzqdDzvdJ3pEAnnZA==
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 5003
accept-ranges: bytes
content-type: text/javascript

GET
H3 200 jquery-3.7.1.min.js Show response
assets.bounceexchange.com/assets/bounce/ 85 KB
30 KB 26ms
26ms Script
text/javascript 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/jquery-3.7.1.min.js
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 07 Jul 2024 23:09:24 GMT
content-encoding: br
age: 254624
x-guploader-uploadid: ACJd0Noy07u3UEOcO8rY2HXVPquAY5qK_G96SZBEJlfmbZyn-Y2UMbSa14ymHDJonmu9DlHOj4c
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31010
last-modified: Mon, 01 Jul 2024 15:41:34 GMT
server: UploadServer
etag: W/"2c872dbe60f4ba70fb85356113d8b35e"
vary: Accept-Encoding
x-goog-generation: 1719848494006967
ad-auction-allowed: true
access-control-allow-origin: *
x-goog-hash: crc32c=fsBEgw==, md5=LIctvmD0unD7hTVhE9izXg==
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 87533
accept-ranges: none
content-type: text/javascript; charset=UTF-8

GET
H2 200 local_storage_frame17.min.html
assets.bounceexchange.com/assets/bounce/ Frame 631C 0
0 82ms
29ms Document
text/html 34.98.72.95
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame17.min.html
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Referer: https://us.norton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: none
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
ad-auction-allowed: true
age: 166315
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=31536000
content-encoding: br
content-length: 938
content-type: text/html; charset=UTF-8
date: Mon, 08 Jul 2024 23:41:13 GMT
etag: W/"fc893948c3efc689b5b19d8a77958e23"
last-modified: Mon, 01 Jul 2024 15:41:33 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1719848493052809
x-goog-hash: crc32c=kX4cqg== md5=/Ik5SMPvxom1sZ2Kd5WOIw==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2408
x-guploader-uploadid: ACJd0NowSqygC5pBw_dot58bmB8Q_mPi5PVNmLlW1K_pVNSeQQWXPvRUIWUqSQsZQ7KUGEkM7xfCAkwIBg

GET
H2 200 c Show response
ids.cdnwidget.com/ 61 B
230 B 166ms
49ms XHR
application/json 34.160.20.10
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ids.cdnwidget.com/c?cookieID=&deviceID=&iv=&v=&GCH1=&SCH1=&GCS1=218046047&GCS2=MTcyLjE3LjAuNCwxMC4xMDAuMC4y&pe=false&wsid=2004&varID=&varData=undefined&log=%7B%22config%22%3A%7B%22gmEN%22%3Atrue%2C%22pixEN%22%3Atrue%7D%2C%22apikey%22%3A%222%5EHIykD%22%2C%22cjsversion%22%3A%221.5.9%22%2C%22wsid%22%3A2004%2C%22loadID%22%3A%22DDGR1fZBbHYby1M%22%2C%22timing%22%3A%7B%22sessionStorageLoad%22%3A3%2C%22IDStageStart%22%3A3%2C%22obsReqview%22%3A116%2C%22obsReqpage%22%3A116%2C%22obsReqdata%22%3A124%2C%22netComplete%22%3A125%2C%22IDStagePrefire%22%3A125%7D%2C%22matches%22%3A%7B%22cookie%22%3Afalse%2C%22LS%22%3Afalse%7D%2C%22info%22%3A%7B%22isSpoofed%22%3Afalse%2C%22PM%22%3Afalse%2C%22DNT%22%3Afalse%2C%22deviceTimezone%22%3A-7%2C%22extensionID%22%3Anull%2C%22externalID%22%3Anull%2C%22agent%22%3A%7B%22device%22%3Anull%7D%2C%22firstLoad%22%3Atrue%7D%2C%22deviceid%22%3A%222974281794298608549%22%2C%22visitid%22%3A%221720648389057690%22%7D
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.20.10 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 10.20.160.34.bc.googleusercontent.com
Software: /
Resource Hash: a9c2c50d3dc4b8e3de6d9f2fc8527e43e7c4dd7ad0826e48398de4c767c02a2f

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:09 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: https://us.norton.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61

POST
H2 200 mon Show response
bite.australiarevival.com/ 0
39 B 47ms
46ms XHR
application/json 50.16.211.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bite.australiarevival.com/mon
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-211-97.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:09 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H2 204 cjs-logger
e.cdnwidget.com/ 0
100 B 151ms
51ms Image
image/png 34.102.193.48
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e.cdnwidget.com/cjs-logger?source=ID%20generation%20error&severity=Warning&error=forbidden%253A%2520disallowed%2520country%252C%2520country%2520code%2520is%2520CA&cookieID=&deviceID=&BXWID=2004&warpspeed=2%5EHIykD&loadID=DDGR1fZBbHYby1M&version=1.5.9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.193.48 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 48.193.102.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Jul 2024 21:53:09 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/png

GET
H2 200 init1.js Show response
api.bounceexchange.com/bounce/ 3 KB
2 KB 203ms
82ms Script
text/javascript 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/init1.js?wklzs=2529&wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgHYAmABgDYAWADgGZqBOG2zYALxCkrMwHcBTAEY5UwfgH1UAEyhlSlTACd+OEABs4aDAXKlSAD3xyl-GP0XLFUbAEM1a1AgDm4uIrVQAFsGAAHHACktACCAcQAYmHhcDgAdAggiqAIsUggALZRgmogTlEYDgj8ALQ4SDbpgRGCMY4qOMUgvEWKxb6eqDgdzqWgigCemABunaLiaSAA1qj8UAGEAEJhxGq+y0GhxMTeflUArCFhexFHETHxicmpGafh2bm3BXWl5ZW3NSJFOA1NLW0dXUcTl6iX662IAGFlop1octutCAARbAgKYzOaLZZSaSwzZbBiEbjUIhMYgMai6ah7SgMcFQrYjKS4ohkKh0RikPaEcgMUhhenEIa4+ZLLbYsogRDAcQVSUIYC4vmQ5aqNxICTAfq+fi4mB2HA65Vimz9HDiUDifj6XyoRQ2LQIXX6w0CxxpdJA8S+RQgKTiHBwQTiNT8ZzATxOtQG-nLUT8SqSBDjGxJRUxrblVPwkJ6qMurH8DT6CTitJStNG4gwW04aWZ6VxzLZ4K56OV6uKWvJpKSMTpcTV-SRtsC-hDczB3JOfh+xzD-Nbb2+uAocTKd3pUNSe3oR3NpUCmwwasOe0arWG4gbVsL4hHk+oM-mi-iactOzz9PENKCO0IbHOF6KbAC0n6VveqCnmIlrjvKYGHsekGPtBvgphUZpgDYe5XjmzpfhBUEanaSDTM48HLDkTjTrOSbSKGaDVjO5FbARyESKhdoJj+f4AXkzY3vhiGEUBnFmtxWG8a4vjbmIzHfsBXoaHaDiasKWyNnSywdhIrFPhg6pyfW-r8Aq-F4ZWRkAI6qfuX5GUMdhwJeGwHsscC+E4dpSDO4ggMeE42A5kE2Nkzm4Xm+GCBJGCbvKQHTnJCCBeI3kjOqib1p+SJflITjhDWwAADIgDYTLNsAihOfMyIOZ2ADa5T-v0a42CR4gjCIoUALqwM6wwpjgDWePwJGSg2fY4D1N79fVSDDaNmj+mIvhTX1tWDaWcrSrKUo9aQM2DXN9riIIID6F6ygGvKq15gddUGt8u7iOkvp2BdKj0TdBp3Rga5jjMvC+Yo3mKEt-Arb1t3rXVDkOH6Za+BgX38HdSBIOICBwOkggTvR5gzsjd0GkgbiiM1aTeZa8r41IhPQ8TGB+t68aoFj4wOCRBOQ999OSoo6WatqdMDXV26muaICWtato7kj3Mo9DboZJ6S5+gGQYhmGnjC-VjZmo43bAHtd2UdRiY64d6M2JofmQSGtPy6jwEW6LhZwMWKWdGW11QPt9MjYzS0SSm8Mc5MXPTf7aT-ilbse0gYcR2tIsdl2RmNi7qd1gpjYDqg+gu2OE6mz5jgu6rK7SuuGSxTJu7G9DunQYL-Au0357aq+obmHYLvif+KvAS0Lt2pBMpSH6v3M1dRuO43QlsTBn1zyL7cieh4iYQgLtRSI6Peqg6o9UTwDB8DF2H631jQ95RbsYol-H9DzMemzB9H9fIu74frjuD1Oz+A2AAeiAecBISQMDXHSIgby1YihSBPmfP0bg1D-x8IAkIICwGXEge6GBpg6gIJvnHCQKC0G7GAaAuI4Crh4P-AQ+Bd0X6s37GQrw6DAiYKoRcCBKQ6GwMIXdVAghzqoWnM+IWK9dYiPihINQJoxpPxFsI86BtawgBIj1fAd0rSdDQIBEm6jNyKDbgvJ8FVWqkScH3DAqgQz+j5h-bE65gAmynKXWi3l5SoEYg7SOItYbSBShkGwZcoAVScndNeHEN7914qYh8T4YlcRAL+CSnp3IySvv42aClfBKTsGTHqjY7raRlGY6C+lsnJ1yT2A0s8cmHQUtZfoDcRb2UclfP2ItVYXw-o0uqvSkqbj7p4e0L1txqBlCgVA45C7pFCVM9Ryg-E1MGqdRA6pVHpGniIOWAylyeQqJIVZUMRbxkWUtRIPkhjED7gpHIpUk5nPqrUQCM5xG-iaAaExUjBruSOd5Se-lQaBUWSFEM5cfRSErhjCo-A7l-LqiFaKCBYrSjEdUl5g0EgOXZjMbxDs7q4psOIDoaAiXQxJa4H50glH1VKqkiQ6QkAekpe01E0xmWvSmdPZeESFYiySkMWOaUJBumdki4VorL5eghpHWBosvZbRlC9XavthiKrFmaC0VobR2gdHTRVSsPSAV6erYMoYnDhiNaYOqetEyGwblqkhnsJTqr9oqrOhtezxjzgXOeiqK6rmrukWustt4aqGIqteLdbUwGRRUjuEg3w91QYGu1cTB5JGHhmhNa8i4+wVXa6JaEExb3jYmxJzdiJWMrSXGiJz6I+JmKcnmMak3rxSWkgezhK2ltEuMVJPEMnSTPJWspa8qmVoBV5HyfkzCgqCvI7qebkVRX-DFeisjCYTC5RLSW8jFDTkdoIXwGqTLnrqgAIiMokcY81JhjWvQAGlvWeJwoJX3Xs8Bkfg37g3AG-QaFMc1r1dUwL4YAeAUQ7NPMgCQMB5FOGvmMqAQA
Requested by: Host: ensighten.norton.com
URL: https://ensighten.norton.com/symantec/aemprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 23a41c68575236e90e2794c569eb31285983c75305eebfe3dcaba8e3edf2a8fb

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:09 GMT
content-encoding: gzip
x-envoy-decorator-operation: legacy-api-tier1.legacy-api.svc.cluster.local:80/*
last-modified: Wed, 10 Jul 2024 21:53:09 GMT
via: 1.1 google
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
cache-control: no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 31
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 200 visit
events.bouncex.net/track.gif/ 42 B
98 B 84ms
60ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/visit?wklz=G4SwziAuBcCuYFMBOBDA5ggdpAvAWQHsAvEAG1JQFIAmAMQFYA6ABhuYAoANARm8oGYAQmwAyITLAAebSQA4AbAH15AFgCUbAIIAHbaQQB1BACMA0lBoN+Adkb95bdqYASAFTwiaAYTakQAawQ2AHEEAGN-Ag1qZi8ACyQCAFsgum5qeRYs1hiAZRQAMxQkEEt6Gzt5ADJQCBgkBALkBqQcGvAoaApMABNxNG10BFgkUhw4yEhtMBpyzVm6Bdp4RkwCJEgCTEYw5KXjUgI0Ja2-TAQAWjAwlCSZ6no6Y3hxBDAwC4IAd3OkC+04uBAZg0FdNkgAJ7tOrQBpgAikWCQEBbSQ4bjyZjMaGdOEIpEozAQ9ExbG1TpheCbJLAYogFAHN44SjWYTUag3XoQxSoCKKcmMmjUATzdlFUiIIXeIVhOLhSJIxRQBB3KX8UXUcWS9nS9my+UERVgSAIbRqjVa1LC6g+dl9a6G7CKW6OyDmoU5a22jlxFCQRTGAiSRTaOFYN069VCy1Sm1CxDvQmKJIEHooUghsPYd1i9Par1CrY8hCgBBfRTrHrIRTG005zV5q266i0vw9RS7WDaLb1mM6uN6sKKCRJYzV8PIBA9XuN2PexCUkqQbm7KuKCcNaeRi2z-vz8JbduhlUgWBJDt+CJTmcSpsD6jwkZhBCKZfaJtR3O3udCtMQsCvgQ66SNoICoMiPbbtGu4Fuy4i7Ek-SZqmNawMYij6CCkBxDe+bNsqdxKpgHbFBGwqfjEP7socaAYO24i4Xe3phEOKBIgQBRkPoW7kTu357jKpGMVR1BVoikgvvanbZlB7Kes2C6HjWkAoL0xTtmEl6BDxIrQfxsEPgevSKGJUgvppIBXjpFF9gZnFIMaJEbEqJpJMJAlimBjk3M5BGKJx0iyQ2+nNiW1Y0XRRHuQZoaprAYT+g0CEpGpEGYPW8n3oUnF+H6L5vh+fF4VlBQ5fSJqvhC76KBgvzptFza7MYqC9EhgwbL8DX3qgZDOj07ZFseiAybxenFd62VkOVL5hSNulfuNQqTblFXtbcAEAFaqV13rGCgEBDqGlmFbGBnGqpaZIEeJTPvWImmRJmbHXdHnUMeiFnk9t1BSJe0HYoIykPWExTDMn60JYKxrBsWw7MksC9I0rw6fe51qVdAOjMDkzTPNEN0FD6ybNsCEI1WnHnCj3oPS+gPY6DeOQ2AqxE7DpOIxT16ve9p7nnTQUg7j4NMyzMMk-DHPIyJIDGMGgwYJV747UKMty0MGEoBChpkfN1oGarRHKQQET1nwr0IJI4DIiCHZUskyDK+yy3Ta+vL+P0jscls8L6DWhpIN9o12mB4Q6-eEVTobIBVtgICcVzQfBYt7KttHJnJCgDFBZASCwExS2lVNeUhsU60dgQzUXR7QW2c2zvF2thFNS1fQ212aYmp7Pn+noIzplAEL1gRIn2S+9cVVsge67X97dzWCA6zZMGNaRigAI7LhlIlz62edb9ziTXc9NfL-esXtpgtwnQt+d6r6kApmmGYoAlIDANfSe39QKqZxmxrrAnaep9dqOmfMGEASQhoQEgonGe3pYpoFQOeaOnsf69X-pufkesgEhVnqvQ4KAqzWSKl-F4NspwK2at8RASBPZdkQYQyOHEmhIGdLSMgDJ9Ce3PvFf0l8UjYKXrgiae1ehbBSj3IYns1i0gvCAcMKCfqvRkSgRQgJkTENOs2FRAMaGKMTiJQhFcXxJDCIhTR-YDK7AIO7ExqZ0yZjeOGesOc97KJQMAEyJZjpEW7tIjxXjQDPhDGaE+IVrAABEcQwGsbY5krJfz6N1tQAAnNYFQ1BZDcGsCkjJKSFDMFkPQFQKSRKgGIdkmIqhZD8FkCk+Q8h+Dsn4M2YA7oEmRObD0NAtAvKQBEAQQh5pXGpG9AUYAi9NCVOYNU2ppSsoEHNDkb0pBQmJ0FvcOYSwliEzFnDNyDwng0ROJgM4lxrjrX2GQt4Hxvi-H+ICMAwJQQYMHq9faSzWnaDaduM21N6xUyFLQpRViJnmmmbMupCkknqguH8oUaAwjAt4tYAyBzeLLKFKQMFvzUUzJUDUqF944hhAAvAaGxNwUsiifAZAQxsDQCoV8GhOB4iJBSFUWlqBaowHfg5QkJJMjMGyJymh9KYB6D9AUdYSQcBiAkJIUVdKeXQCrEEheVUEA4CrGAfwmxtBVEpP-FISBoC+gdJgPlJoeg4GxBgAg0BpI5whKuLVXhNBVHtY610kJXX8FZZoAAcp6hADqnWQn4W61ShCUAhodQ0NAAqADywavUJsJJGnASbsB0gIHGx1A8cCuHWFsTY+buznVIK6-A9APVet2LHc42Bq2Bo9Y-LV2IvgmDqAgaOOBSQqGiX2iFBK5kNKadQfgVQ1XHT7ak9JmTsm5NSQUopJSqjy28WWYdVREBrzzpgZ8fbsQWXDMiFI51IHojxZCtJWJDV+HDCgUCfLoGYBwCpNAU6Z3Pm1VUbCYEjykW5Bg9W9pOFThwJaf9RACA4AydiR8ActVduMFUcVOAuVAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:09 GMT
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 8
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 pageview
events.bouncex.net/track.gif/ 42 B
99 B 75ms
52ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/pageview?wklz=A4Qw5gpgbglhDuAuArgJwDYF4AWAXXwAzgKQDMAgsQEwBi1NyhAdAHYD2qubLTAxmwFt6AI3Rsw9buhgsIAWkK8QAkrWGMZEQoTlt4s1HODYYhEyzAKuqAJ4AyUJFgJEvRlwFQQqGCFFbMYgB2ACFqKiUWABMbAH1UEF4Aa1jYQhh-cLJKKioAMxB0QggsqgBhcN5sCGS2ZFxYmFwIFSyKcIKiktzqCtyqmqS6hsJm4Dac-MLi0r6qKNN+ZBYG5TqVifCABlnK7BAG4TYAD1jgVC0IDZ723M6ZnvLw4u0YbliBNijCs4vi66o2Q6026gKeuXeF2c8FiHCiEFQsVGEHGN0m91BvXCXmkUViS2A3E2dxBu36vFiLGQAmECNiV2aFyixKmXTJVGKbh8uDi-Hh9JWCIgzLRwLZjzmnO4ePOLRg1Px0mSwpZGPZhDqqF4EFiPOAmNurIeYLm3xshF1bHpx2AMASuDeLFVpIl4Rk-AEMjAvy+SOQwli6CuYFw2Gd4pNbuaKkaLHx3lwLJ2rtyYjAkDxMnDxqx5NiIHqbDyMHQQZFgMNapTEQT2cx4PmEHQyGOOoWinWidFuWTkdyUuiSNwIGi3jxvCVSRV3aN9clNWlsXhzdbipgyvLQJJEdz+Tto3jnEa0br7OLqAPSiPTRasWLx1P1egdLTGdjj77VHOX2QvAaFw9AQrm+B0iRnXtdxAPJi2kA4dT1A10RdT8oJg3xml1Gx9ViSADEKD9d34YQEmiL0zgTAwCIbBIS3zKI8XeWV-i7CskJ3BtUJLdCdWfAEt1ndlONgjDQASGMACsRyouZhBAdIKXOddENKT9RhHb5UBlHxtRZdllxbHVFJ0md2VlT0FSM5THk-WT5NiNB0BZPACBIW46FoRhWA4LgeA9ZZ4WLWRNwbNTR00+yMCc-AiC3dyGGYdhOG4PhBH8iBAunT99NXByopc2L6E8xKfJSgQ0oy4K5jM+UBAixyZ2cmK3MKhLvOSvzonSzRKrdYRTkceCsKsgTqwyfrwB1dAQBsYZdNGvrYyHNhkhZABGdkIGOUwHQsfF3EEBFpPCITuN1BJki9I7+m4DUgyRTVjNY8IFgAljd1fYVFpgeEVhgYtMv4qtPxxb6l0EEAsxnXBUGQOdjugri4PIsSLSIkiFgsK6qBOpHROUVG2GI9SyOQYAQOGoHCITM5mwSaQeRZG8hGrc8dRxjDuEewHkKpo9ijeyseYbK8GgARwZ8D2RF1JClhpNTNQX1LKx788RYZQKaFuYqgOT5vnQfM-xgKBNfYuYWghg3Rg4AHBbN8IjmWbVThgAQmPSMCnu3HMG2-MAxMaTc7Z982BEtpamVSMEvZGz9pbEEB4SDtiQ-CDRduFSBYmIvRilQLHSf9xPPqLPI6RALwSz8IMVcVqJfwadWgOj7n7dyPx1O4ICVnIyAsfYLw1wZb65s-AeQFiEwHWTlTd3H+y85Hkzq0TwmdQEXhPRn6zCLYNgkjgD4vh+JiGRZaG5erdWoCXaAlNjEX+4r2-YG1M5URjymggAEQcCboVcHvA+WgYAAC8ICYFWlsUgABWP+Tg4BIEiNwdchQcDRVcjkOKRU2q+UECINMkgWDSFkAoJQrQ1Dpy0DoPQBgjAmDMF6KwHB7ADQAfwfeh8uBWimqgSAmAMTwLvi4DhwDML6kwKQYARQhHsKAYfdI4DMBUAACwADY4EemAK4N2mAth2C0YgXAvA8h6IMYIbRjBgBmMMWAYA1j9F6wgfo+AEBhDpGaN9ZRWwtgqLsGkJoXjVpBCoFsNRKiAAcpAIkAE41FqNILkUgdh4SvwgF4qgMSggqKoBE4JMSckxIiWorYESYEqJibIxBQS7DFFFrDFg2oakTjgCsB0QE1K6OCaE8JUTYlBGgQY6QDIQC2hNheR0mBhxgGSakpSmAoh2FDHaGUCY4jWwSFnds1dhQCJBEs0BbBMA5P0RqNA2pMCuOEHYCaKxMCMAREAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:09 GMT
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 2
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 item
events.bouncex.net/track.gif/ 42 B
96 B 75ms
53ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/item?wklz=JYFwpgtgXMAmC8IAWYC0ID2AbLqMDNUBDVAByWAGcKA7Ac1UoGMiI8bjGIidUAjAK6VgNMJUp4A7qIBOAMlCQoTDKQCe8ACooApACYADJhz6DBU0VPkqtOqeatTGGhfvcThwcNHin0sPKK0CzgdBgyGjThmDQK4NDA3HRgAjJY8EggIKSUOgDMAIL6AGIlgmqMIEQgwEwAdFEyMXUqECWNMSU5JUT4+II0sFhiJYlEybl6xVgYYagdzqg4daT0cUqp6ZnZuYUlJUIN0c4tGG1TfDN2U85YImgOEJPFXvfiUrJkFNQiDJSYEXWCRo-wwTAA1ogZAIwHIIBhYGB4AY5JIwHxhOA4PBDAYACxyABuVFA2IAjAB2QwANjxAA48nSAJzU6l5PR6PJyRHEphgbF6JkUvF6OmUpkipl06kGOkAVjxTLkpHGYGJYEk5LklDAAEcYTQ+QK5Ew7mAaFlEmIqhBSPBKTT6YyhQYlabgOaqqRgISAsJnIhxlyebUkbA5MhgDJYAB9FVNNQx0EyVUx2BUIiXMAIfA8HURgBeGHgIpRlAwqT58DRfDkqot8CEASAA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:09 GMT
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

GET
H2 200 view%20item
events.bouncex.net/track.gif/ 42 B
206 B 72ms
49ms Image
image/gif 34.111.8.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.bouncex.net/track.gif/view%20item?wklz=JYFwpgtgXMAmC8IAWYC0ID2AbLqMDNUBDVAByWAGcKA7Ac1UoGMiI8bjGIidUAjAK6VgNMJUp4A7qIBOAMggZYYeAAY5ksH2Hg48AEyrVAFjkA3KqD0BGAOyGAbMYAcAZmcBOBw9f79ruWULJjA9fQ9bY31nOw8oj2cHVWcAVmMPOVIiOjALMEkbOUowAEcBMBoQvQCmLGAKkBBgCDEQVlJ4O0cXdwjVDNr6mjbSYDMwGWEMGkRsgKDgEPhYOWRgGVgAfSyZEABPTcpMGWywTdgqIj4sMAR8HmLVgC8MeCj1SgwBGSXNPjlTsN4EIJkA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://us.norton.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 10 Jul 2024 21:53:09 GMT
x-envoy-decorator-operation: event-collector.event-collector.svc.cluster.local:80/*
via: 1.1 google
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time: 0
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
expires: Tue, 01 Jan 2001 00:00:00 GMT

POST
H2 200 norton
ingest.quantummetric.com/horizon/ Frame E7BF 0
0 97ms
95ms Fetch
application/json 34.134.162.16
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ingest.quantummetric.com/horizon/norton?T=B&u=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&t=1720648383896&v=1720648390111&H=c2028f6673bd1ec2effc56a2&s=48be5c7ecae2f98573ec67f274f64da2&S=103435&N=144&P=2&z=1

Requested by

Host: cdn.quantummetric.com
URL: https://cdn.quantummetric.com/qscripts/quantum-norton.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.162.16 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://us.norton.com
date: Wed, 10 Jul 2024 21:53:10 GMT
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
content-length: 0
content-type: application/json

POST
H2 200 norton
ingest.quantummetric.com/horizon/ Frame E7BF 0
0 76ms
75ms Fetch
application/json 34.134.162.16
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ingest.quantummetric.com/horizon/norton?T=B&u=https%3A%2F%2Fus.norton.com%2Fblog%2Fonline-scams%2Fbusiness-owner-phishing-story&t=1720648383896&v=1720648390211&H=c2028f6673bd1ec2effc56a2&s=48be5c7ecae2f98573ec67f274f64da2&Q=2&S=1510&N=1&z=1

Requested by

Host: cdn.quantummetric.com
URL: https://cdn.quantummetric.com/qscripts/quantum-norton.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.162.16 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS