urlscan.io logo urlscan.io
SecurityTrails logo

threatpost.com Open in urlscan Pro
35.173.160.135  Public Scan

Go To Rescan Add Verdict Report
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Submission: On November 30 via api from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 124 IPs in 12 countries across 105 domains to perform 566 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 2nd 2021. Valid for: a year.
This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
17 35.173.160.135 14618 (AMAZON-AES)
11 13.225.77.18 16509 (AMAZON-02)
5 2a00:1450:400... 15169 (GOOGLE)
7 2606:4700:303... 13335 (CLOUDFLAR...)
20 2600:9000:20e... 16509 (AMAZON-02)
10 2600:9000:21f... 16509 (AMAZON-02)
1 8 2a00:1450:400... 15169 (GOOGLE)
4 13.224.198.4 16509 (AMAZON-02)
1 7 151.101.66.137 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
16 3.133.209.138 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
23 41 142.250.185.130 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
5 7 2620:116:800d... 16509 (AMAZON-02)
1 151.101.12.157 54113 (FASTLY)
1 64.140.160.2 18450 (WEBNX)
1 151.101.2.137 54113 (FASTLY)
9 151.101.194.137 54113 (FASTLY)
4 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:20e... 16509 (AMAZON-02)
1 104.244.42.3 13414 (TWITTER)
1 104.244.42.5 13414 (TWITTER)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 54.36.109.22 16276 (OVH)
1 2 2a02:2638::1c 44788 (ASN-CRITE...)
2 178.250.2.146 44788 (ASN-CRITE...)
3 184.31.84.150 16625 (AKAMAI-AS)
2 10 34.98.64.218 15169 (GOOGLE)
5 213.19.147.43 26120 (RHYTHMONE)
3 185.64.189.112 62713 (AS-PUBMATIC)
1 18.193.57.131 16509 (AMAZON-02)
4 17 185.33.221.52 29990 (ASN-APPNEX)
1 3 147.75.38.124 54825 (PACKET)
14 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 7 165.227.252.242 14061 (DIGITALOC...)
3 3.124.10.167 16509 (AMAZON-02)
3 6 72.251.249.13 29791 (VOXEL-DOT...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 35.157.246.167 16509 (AMAZON-02)
1 52.59.85.35 16509 (AMAZON-02)
4 2602:803:c003... 26667 (RUBICONPR...)
10 52.211.212.107 16509 (AMAZON-02)
24 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 37.252.161.190 29990 (ASN-APPNEX)
1 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 10 185.33.220.100 29990 (ASN-APPNEX)
19 2a00:1450:400... 15169 (GOOGLE)
1 151.101.193.108 54113 (FASTLY)
1 37.252.167.215 29990 (ASN-APPNEX)
18 2a00:1288:80:... 203220 (YAHOO-DEB)
4 151.101.129.108 54113 (FASTLY)
1 216.58.212.166 15169 (GOOGLE)
1 64.233.184.154 15169 (GOOGLE)
1 13.225.77.128 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
8 2a00:1450:400... 15169 (GOOGLE)
6 2.18.235.40 16625 (AKAMAI-AS)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 34.210.233.105 16509 (AMAZON-02)
9 2.18.233.180 16625 (AKAMAI-AS)
6 33 2.18.234.21 16625 (AKAMAI-AS)
4 5 151.101.194.49 54113 (FASTLY)
5 5 18.158.154.136 16509 (AMAZON-02)
3 7 18.156.0.31 16509 (AMAZON-02)
6 13 35.71.131.137 16509 (AMAZON-02)
7 142.250.181.226 15169 (GOOGLE)
1 3.10.67.38 16509 (AMAZON-02)
1 35.179.78.10 16509 (AMAZON-02)
2 15 35.244.159.8 15169 (GOOGLE)
4 104.111.242.245 16625 (AKAMAI-AS)
9 9 185.29.132.245 30419 (MEDIAMATH...)
5 6 37.157.4.29 198622 (ADFORM)
1 198.47.127.19 3257 (GTT-BACKB...)
2 2 213.155.156.180 1299 (TWELVE99 ...)
3 185.64.190.80 62713 (AS-PUBMATIC)
1 198.47.127.20 62713 (AS-PUBMATIC)
1 2 51.210.112.236 16276 (OVH)
2 2 34.254.143.3 16509 (AMAZON-02)
1 2 159.122.14.34 36351 (SOFTLAYER)
2 185.64.189.110 62713 (AS-PUBMATIC)
3 7 52.46.130.91 16509 (AMAZON-02)
4 7 185.33.220.243 29990 (ASN-APPNEX)
2 192.132.33.46 18568 (BIDTELLECT)
2 2 34.225.96.147 14618 (AMAZON-AES)
5 5 193.0.160.129 54312 (ROCKETFUEL)
2 2 154.59.122.79 174 (COGENT-174)
1 1 3.232.127.49 14618 (AMAZON-AES)
4 142.250.184.226 15169 (GOOGLE)
1 151.101.65.108 54113 (FASTLY)
1 1 134.209.131.220 14061 (DIGITALOC...)
1 205.185.216.10 20446 (HIGHWINDS3)
1 2620:1ec:46::60 8068 (MICROSOFT...)
2 7 13.248.245.213 16509 (AMAZON-02)
8 104.109.78.125 16625 (AKAMAI-AS)
1 35.186.253.211 15169 (GOOGLE)
3 6 2a05:d018:d29... 16509 (AMAZON-02)
2 2 3.126.16.11 16509 (AMAZON-02)
13 14 35.156.121.212 16509 (AMAZON-02)
2 2 63.33.204.129 16509 (AMAZON-02)
5 7 52.16.229.21 16509 (AMAZON-02)
1 213.19.162.80 26667 (RUBICONPR...)
1 1 66.155.71.150 13768 (COGECO-PEER1)
1 17 216.52.2.19 30282 (AS-INAPCD...)
2 2 18.196.123.190 16509 (AMAZON-02)
12 12 213.19.147.45 26120 (RHYTHMONE)
2 8.43.72.97 26667 (RUBICONPR...)
2 2 52.215.102.174 16509 (AMAZON-02)
1 2.18.235.93 16625 (AKAMAI-AS)
3 3 198.148.27.140 19189 (PULSEPOINT)
2 50.19.13.13 14618 (AMAZON-AES)
1 1 52.203.137.199 14618 (AMAZON-AES)
1 2 52.95.119.178 16509 (AMAZON-02)
6 6 185.184.8.65 204995 (RTB-HOUSE...)
4 4 35.210.53.219 15169 (GOOGLE)
2 3 104.111.242.53 16625 (AKAMAI-AS)
1 34 54.77.19.59 16509 (AMAZON-02)
1 1 2001:678:cb4:... 56396 (AMOBEE)
1 34.249.15.20 16509 (AMAZON-02)
3 67.202.105.21 32748 (STEADFAST)
1 51.89.9.254 16276 (OVH)
3 185.86.138.132 201081 (SMARTADSE...)
3 178.162.133.149 60781 (LEASEWEB-...)
1 82.145.213.8 39832 (NO-OPERA)
1 2620:119:50e5... 14413 (LINKEDIN)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
4 4 50.31.142.159 23352 (SERVERCEN...)
3 3 2001:678:cb4:... 56396 (AMOBEE)
1 1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
2 2 3.228.133.61 14618 (AMAZON-AES)
2 2 18.192.161.141 16509 (AMAZON-02)
3 4 64.202.112.159 23352 (SERVERCEN...)
1 1 52.3.139.221 14618 (AMAZON-AES)
2 2 3.210.4.50 14618 (AMAZON-AES)
2 132.226.41.106 31898 (ORACLE-BM...)
3 38.91.45.7 398989 (DEEPINTENT)
4 4 34.255.38.72 16509 (AMAZON-02)
3 13.224.193.60 16509 (AMAZON-02)
1 35.241.40.233 15169 (GOOGLE)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
3 3 2.19.35.65 16625 (AKAMAI-AS)
3 18.195.155.181 16509 (AMAZON-02)
2 2 202.241.208.52 4694 (IDCF IDC ...)
1 1 104.111.215.191 16625 (AKAMAI-AS)
1 1 51.255.68.171 16276 (OVH)
2 5 185.86.138.114 201081 (SMARTADSE...)
3 69.173.144.165 26667 (RUBICONPR...)
1 35.244.174.68 15169 (GOOGLE)
2 2 69.173.144.138 26667 (RUBICONPR...)
1 178.162.133.148 60781 (LEASEWEB-...)
2 2 54.84.15.237 14618 (AMAZON-AES)
1 2600:1f18:444... 14618 (AMAZON-AES)
1 185.64.190.81 62713 (AS-PUBMATIC)
566 124
17    35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com
threatpost.com
kasperskycontenthub.com
11    13.225.77.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-77-18.fra2.r.cloudfront.net
tagan.adlightning.com
5    2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
7    2606:4700:3030::ac43:cf70 (United States)

ASN13335 (CLOUDFLARENET, US)
qd.admetricspro.com
20    2600:9000:20eb:fa00:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)
assets.threatpost.com
10    2600:9000:21f3:8600:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)
media.threatpost.com
8    2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
4    13.224.198.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-198-4.fra2.r.cloudfront.net
c.amazon-adsystem.com
7    151.101.66.137 (United States)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
img.connatix.com
1    2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
16    3.133.209.138 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-133-209-138.us-east-2.compute.amazonaws.com
capi.connatix.com
4    2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
41    142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net
securepubads.g.doubleclick.net
pubads.g.doubleclick.net
cm.g.doubleclick.net
3    2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
7    2620:116:800d:21:ee05:6a01:4b41:8c89 (United States)

ASN16509 (AMAZON-02, US)
secure.quantserve.com
pixel.quantserve.com
1    151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
1    64.140.160.2 (Ogden, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com
geo.ipify.org
1    151.101.2.137 (United States)

ASN54113 (FASTLY, US)
lit.connatix.com
9    151.101.194.137 (United States)

ASN54113 (FASTLY, US)
vid.connatix.com
4    2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
imasdk.googleapis.com
1    2600:9000:20eb:3200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
1    104.244.42.3 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    104.244.42.5 (United States)

ASN13414 (TWITTER, US)
t.co
1    2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2606:4700:20::681a:8a9 (United States)

ASN13335 (CLOUDFLARENET, US)
script.4dex.io
1    54.36.109.22 (France)

ASN16276 (OVH, FR)
PTR: p09.id5-sync.com
id5-sync.com
2    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
2    178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
3    184.31.84.150 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-84-150.deploy.static.akamaitechnologies.com
htlb.casalemedia.com
10    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
teachingaids-d.openx.net
u.openx.net
us-u.openx.net
eu-u.openx.net
gift-connect-d.openx.net
5    213.19.147.43 (United Kingdom)

ASN26120 (RHYTHMONE, US)
tag.1rx.io
3    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
1    18.193.57.131 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-57-131.eu-central-1.compute.amazonaws.com
ads.adaptv.advertising.com
17    185.33.221.52 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
3    147.75.38.124 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
prebid.a-mo.net
14    2a00:1450:4001:813::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s0.2mdn.net
1    2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.co.uk
7    165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
e.serverbid.com
3    3.124.10.167 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-10-167.eu-central-1.compute.amazonaws.com
btlr.sharethrough.com
6    72.251.249.13 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
1    2606:4700::6812:272 (United States)

ASN13335 (CLOUDFLARENET, US)
mp.4dex.io
3    35.157.246.167 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
c2shb.ssp.yahoo.com
1    52.59.85.35 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-85-35.eu-central-1.compute.amazonaws.com
tlx.3lift.com
4    2602:803:c003:200::21 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
10    52.211.212.107 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
ads.servenobid.com
24    2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
4    2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
2    37.252.161.190 (Southall, United Kingdom)

ASN29990 (ASN-APPNEX, US)
PTR: prebid.ams1.adnexus.net
prebid.adnxs.com
1    2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.co.uk
5    2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
10    185.33.220.100 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ams1-ib.adnxs.com
19    2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
1    151.101.193.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs-simple.com
1    37.252.167.215 (Southall, United Kingdom)

ASN29990 (ASN-APPNEX, US)
PTR: 58.ratbait.prod.ams1.adnexus.net
rb.adnxs-simple.com
18    2a00:1288:80:800::7001 (Frankfurt am Main, Germany)

ASN203220 (YAHOO-DEB, GB)
pr.ybp.yahoo.com
s.yimg.com
ads.yahoo.com
beap-bc.yahoo.com
4    151.101.129.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
1    216.58.212.166 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f6.1e100.net
ad.doubleclick.net
1    64.233.184.154 (United States)

ASN15169 (GOOGLE, US)
PTR: wa-in-f154.1e100.net
bid.g.doubleclick.net
1    13.225.77.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-77-128.fra2.r.cloudfront.net
choices.truste.com
2    2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
8    2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
6    2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com
yahoovpaidtwoint215831825037.s.moatpixel.com
1    2a00:1450:4001:82f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
gcdn.2mdn.net
1    2a00:1450:4009::8 (London, United Kingdom)

ASN15169 (GOOGLE, US)
r3---sn-aigzrne7.c.2mdn.net
1    34.210.233.105 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-210-233-105.us-west-2.compute.amazonaws.com
id.sharedid.org
9    2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com
ads.pubmatic.com
33    2.18.234.21 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com
js-sec.indexww.com
dsum-sec.casalemedia.com
ssum-sec.casalemedia.com
dsum.casalemedia.com
5    151.101.194.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
5    18.158.154.136 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-154-136.eu-central-1.compute.amazonaws.com
pixel.advertising.com
7    18.156.0.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
13    35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
data.adsrvr.org
7    142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net
googleads4.g.doubleclick.net
1    3.10.67.38 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-10-67-38.eu-west-2.compute.amazonaws.com
geo.moatads.com
1    35.179.78.10 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-179-78-10.eu-west-2.compute.amazonaws.com
mb.moatads.com
15    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
us-u.openx.net
eu-u.openx.net
4    104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com
sync.teads.tv
9    185.29.132.245 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
6    37.157.4.29 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
1    198.47.127.19 (United States)

ASN3257 (GTT-BACKBONE GTT, US)
image6.pubmatic.com
2    213.155.156.180 (Uppsala, Sweden)

ASN1299 (TWELVE99 Twelve99, Telia Carrier, SE)
PTR: 213-155-156-180.teliacarrier-cust.com
d5p.de17a.com
3    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
1    198.47.127.20 (United States)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
2    51.210.112.236 (France)

ASN16276 (OVH, FR)
PTR: pikafka-1.cloudy.ovh
pixel.onaudience.com
2    34.254.143.3 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-143-3.eu-west-1.compute.amazonaws.com
loada.exelator.com
2    159.122.14.34 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 22.0e.7a9f.ip4.static.sl-reverse.com
um.simpli.fi
2    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
7    52.46.130.91 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
7    185.33.220.243 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
2    192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com
bttrack.com
2    34.225.96.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-96-147.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
5    193.0.160.129 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
2    154.59.122.79 (United States)

ASN174 (COGENT-174, US)
ums.acuityplatform.com
1    3.232.127.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-127-49.compute-1.amazonaws.com
nep.advangelists.com
4    142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net
ade.googlesyndication.com
1    151.101.65.108 (United States)

ASN54113 (FASTLY, US)
cdn.adnxs.com
1    134.209.131.220 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
sync.serverbid.com
1    205.185.216.10 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1    2620:1ec:46::60 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
public.servenobid.com
7    13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com
eb2.3lift.com
8    104.109.78.125 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
1    35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com
rtb.openx.net
6    2a05:d018:d29:3601:ba88:8e4e:431:61be (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
pr-bh.ybp.yahoo.com
2    3.126.16.11 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-16-11.eu-central-1.compute.amazonaws.com
pm.w55c.net
14    35.156.121.212 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-121-212.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    63.33.204.129 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-204-129.eu-west-1.compute.amazonaws.com
ads.avct.cloud
7    52.16.229.21 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-229-21.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
1    213.19.162.80 (United Kingdom)

ASN26667 (RUBICONPROJECT, US)
pixel-eu.rubiconproject.com
1    66.155.71.150 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
17    216.52.2.19 (United States)

ASN30282 (AS-INAPCDN-OCY, US)
ce.lijit.com
2    18.196.123.190 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-123-190.eu-central-1.compute.amazonaws.com
rtb.mfadsrvr.com
12    213.19.147.45 (United Kingdom)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
2    8.43.72.97 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
2    52.215.102.174 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-102-174.eu-west-1.compute.amazonaws.com
bcp.crwdcntrl.net
1    2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com
contextual.media.net
3    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
2    50.19.13.13 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-19-13-13.compute-1.amazonaws.com
jadserve.postrelease.com
1    52.203.137.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-137-199.compute-1.amazonaws.com
aorta.clickagy.com
2    52.95.119.178 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
6    185.184.8.65 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net
creativecdn.com
4    35.210.53.219 (Brussels, Belgium)

ASN15169 (GOOGLE, US)
PTR: 219.53.210.35.bc.googleusercontent.com
pool.admedo.com
3    104.111.242.53 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-53.deploy.static.akamaitechnologies.com
px.owneriq.net
34    54.77.19.59 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
rtb.gumgum.com
1    2001:678:cb4:bbbb::13 (United Kingdom)

ASN56396 (AMOBEE, GB)
d.turn.com
1    34.249.15.20 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-15-20.eu-west-1.compute.amazonaws.com
g2.gumgum.com
3    67.202.105.21 (United States)

ASN32748 (STEADFAST, US)
PTR: ip21.67-202-105.static.steadfastdns.net
pixel.33across.com
ssc-cms.33across.com
1    51.89.9.254 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip254.ip-51-89-9.eu
onetag-sys.com
3    185.86.138.132 (France)

ASN201081 (SMARTADSERVER, FR)
ssbsync.smartadserver.com
3    178.162.133.149 (Rotterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
1    82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology
t.adx.opera.com
1    2620:119:50e5:101::9002:c05 (San Francisco, United States)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
1    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
4    50.31.142.159 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: chi.outbrain.com
b1sync.zemanta.com
3    2001:678:cb4:bbbb::11 (United Kingdom)

ASN56396 (AMOBEE, GB)
ad.turn.com
1    2a02:fa8:8806:16::1400 (Singapore)

ASN41041 (VCLK-EU-SE, US)
casale-match.dotomi.com
2    3.228.133.61 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-228-133-61.compute-1.amazonaws.com
sync.srv.stackadapt.com
2    18.192.161.141 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-192-161-141.eu-central-1.compute.amazonaws.com
ads.creative-serving.com
4    64.202.112.159 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com
sync.outbrain.com
1    52.3.139.221 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-139-221.compute-1.amazonaws.com
sync.hgrtb.com
2    3.210.4.50 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-210-4-50.compute-1.amazonaws.com
sync.ipredictive.com
2    132.226.41.106 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
3    38.91.45.7 (United States)

ASN398989 (DEEPINTENT, US)
match.deepintent.com
4    34.255.38.72 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-38-72.eu-west-1.compute.amazonaws.com
ad.360yield.com
3    13.224.193.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-60.fra2.r.cloudfront.net
choices.trustarc.com
1    35.241.40.233 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 233.40.241.35.bc.googleusercontent.com
dmp.brand-display.com
1    2606:4700:20::681a:ad1 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
3    2.19.35.65 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-35-65.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
3    18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
cs.emxdgt.com
2    202.241.208.52 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)
tg.socdm.com
1    104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    51.255.68.171 (France)

ASN16276 (OVH, FR)
PTR: ns3028611.ip-51-255-68.eu
dsp.nrich.ai
5    185.86.138.114 (France)

ASN201081 (SMARTADSERVER, FR)
rtb-csync.smartadserver.com
3    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
2    69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
1    178.162.133.148 (Rotterdam, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1.go.sonobi.com
go.sonobi.com
2    54.84.15.237 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-15-237.compute-1.amazonaws.com
i.liadm.com
1    2600:1f18:444a:4602:b51a:2bef:14:5241 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
1    185.64.190.81 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage4.pubmatic.com
Apex Domain
Subdomains		 Transfer
59 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
pubads.g.doubleclick.net
ad.doubleclick.net
bid.g.doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
googleads4.g.doubleclick.net
307 KB
52 googlesyndication.com
pagead2.googlesyndication.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
tpc.googlesyndication.com
ade.googlesyndication.com
282 KB
45 threatpost.com
threatpost.com
assets.threatpost.com
media.threatpost.com
1006 KB
41 adnxs.com
ib.adnxs.com
prebid.adnxs.com
ams1-ib.adnxs.com
acdn.adnxs.com
secure.adnxs.com
cdn.adnxs.com
157 KB
35 gumgum.com
rtb.gumgum.com
g2.gumgum.com
11 KB
33 connatix.com
cd.connatix.com
cds.connatix.com
capi.connatix.com
lit.connatix.com
vid.connatix.com
img.connatix.com
808 KB
32 yahoo.com
c2shb.ssp.yahoo.com
pr.ybp.yahoo.com
ups.analytics.yahoo.com
pr-bh.ybp.yahoo.com
ads.yahoo.com
beap-bc.yahoo.com
38 KB
30 casalemedia.com
htlb.casalemedia.com
dsum-sec.casalemedia.com
ssum-sec.casalemedia.com
dsum.casalemedia.com
33 KB
26 openx.net
teachingaids-d.openx.net
u.openx.net
us-u.openx.net
eu-u.openx.net
rtb.openx.net
gift-connect-d.openx.net
5 KB
23 rubiconproject.com
fastlane.rubiconproject.com
eus.rubiconproject.com
pixel-eu.rubiconproject.com
pixel-us-east.rubiconproject.com
secure-assets.rubiconproject.com
pixel.rubiconproject.com
token.rubiconproject.com Failed
50 KB
23 lijit.com
ap.lijit.com
ce.lijit.com
28 KB
20 pubmatic.com
hbopenbid.pubmatic.com
ads.pubmatic.com
image6.pubmatic.com
image2.pubmatic.com
image4.pubmatic.com
simage2.pubmatic.com
simage4.pubmatic.com
62 KB
16 2mdn.net
s0.2mdn.net
gcdn.2mdn.net
r3---sn-aigzrne7.c.2mdn.net
13 MB
14 bidswitch.net
x.bidswitch.net
6 KB
13 adsrvr.org
match.adsrvr.org
data.adsrvr.org
5 KB
13 1rx.io
tag.1rx.io
sync.1rx.io
5 KB
13 amazon-adsystem.com
c.amazon-adsystem.com
s.amazon-adsystem.com
aax-eu.amazon-adsystem.com
45 KB
12 google.com
www.google.com
adservice.google.com
3 KB
11 servenobid.com
ads.servenobid.com
public.servenobid.com
7 KB
11 adlightning.com
tagan.adlightning.com
262 KB
9 mathtag.com
sync.mathtag.com
5 KB
8 smartadserver.com
ssbsync.smartadserver.com
rtb-csync.smartadserver.com
3 KB
8 3lift.com
tlx.3lift.com
eb2.3lift.com
3 KB
8 serverbid.com
e.serverbid.com
sync.serverbid.com
1 KB
7 bidr.io
match.prod.bidr.io
3 KB
7 quantserve.com
secure.quantserve.com
pixel.quantserve.com
12 KB
7 admetricspro.com
qd.admetricspro.com
324 KB
6 creativecdn.com
creativecdn.com
2 KB
6 adform.net
c1.adform.net
3 KB
6 indexww.com
js-sec.indexww.com
6 KB
6 advertising.com
ads.adaptv.advertising.com
pixel.advertising.com
2 KB
6 googleapis.com
imasdk.googleapis.com
fonts.googleapis.com
695 KB
5 moatpixel.com
yahoovpaidtwoint215831825037.s.moatpixel.com
1 KB
5 rfihub.com
p.rfihub.com
4 KB
5 everesttech.net
sync-tm.everesttech.net
1 KB
5 googletagservices.com
www.googletagservices.com
172 KB
4 360yield.com
ad.360yield.com
1 KB
4 outbrain.com
sync.outbrain.com
1 KB
4 zemanta.com
b1sync.zemanta.com
2 KB
4 sonobi.com
sync.go.sonobi.com
go.sonobi.com
2 KB
4 turn.com
d.turn.com
ad.turn.com
2 KB
4 admedo.com
pool.admedo.com
1 KB
4 unrulymedia.com
sync.targeting.unrulymedia.com
2 KB
4 teads.tv
sync.teads.tv
688 B
4 criteo.com
gum.criteo.com
mug.criteo.com
1 KB
4 gstatic.com
www.gstatic.com
147 KB
3 liadm.com
i.liadm.com
i6.liadm.com
2 KB
3 emxdgt.com
cs.emxdgt.com
3 trustarc.com
choices.trustarc.com
15 KB
3 deepintent.com
match.deepintent.com
76 B
3 33across.com
pixel.33across.com
ssc-cms.33across.com
3 owneriq.net
px.owneriq.net
1 KB
3 contextweb.com
bh.contextweb.com
1 KB
3 moatads.com
z.moatads.com
geo.moatads.com
mb.moatads.com
113 KB
3 sharethrough.com
btlr.sharethrough.com
337 B
3 a-mo.net
prebid.a-mo.net
893 B
3 4dex.io
script.4dex.io
mp.4dex.io
24 KB
3 google-analytics.com
www.google-analytics.com
20 KB
2 socdm.com
tg.socdm.com
1 KB
2 technoratimedia.com
sync.technoratimedia.com
586 B
2 ipredictive.com
sync.ipredictive.com
856 B
2 creative-serving.com
ads.creative-serving.com
1 KB
2 stackadapt.com
sync.srv.stackadapt.com
1 KB
2 postrelease.com
jadserve.postrelease.com
855 B
2 crwdcntrl.net
bcp.crwdcntrl.net
1 KB
2 mfadsrvr.com
rtb.mfadsrvr.com
1 KB
2 avct.cloud
ads.avct.cloud
888 B
2 w55c.net
pm.w55c.net
2 KB
2 acuityplatform.com
ums.acuityplatform.com
1 KB
2 cognitivlabs.com
beacon.lynx.cognitivlabs.com
753 B
2 bttrack.com
bttrack.com
760 B
2 simpli.fi
um.simpli.fi
1014 B
2 exelator.com
loada.exelator.com
2 KB
2 onaudience.com
pixel.onaudience.com
735 B
2 de17a.com
d5p.de17a.com
637 B
2 yimg.com
s.yimg.com
44 KB
2 adnxs-simple.com
acdn.adnxs-simple.com
rb.adnxs-simple.com
44 KB
2 google.co.uk
www.google.co.uk
adservice.google.co.uk
1 KB
2 kasperskycontenthub.com
kasperskycontenthub.com
1 KB
1 rlcdn.com
id.rlcdn.com
1 nrich.ai
dsp.nrich.ai
492 B
1 bluekai.com
stags.bluekai.com
1 KB
1 ad4m.at
ad4m.at
1 brand-display.com
dmp.brand-display.com
253 B
1 hgrtb.com
sync.hgrtb.com
438 B
1 dotomi.com
casale-match.dotomi.com
187 B
1 bing.com
c.bing.com
594 B
1 linkedin.com
px.ads.linkedin.com
597 B
1 opera.com
t.adx.opera.com
409 B
1 onetag-sys.com
onetag-sys.com
814 B
1 clickagy.com
aorta.clickagy.com
658 B
1 media.net
contextual.media.net
289 B
1 sitescout.com
pixel-sync.sitescout.com
270 B
1 digitaloceanspaces.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
5 KB
1 advangelists.com
nep.advangelists.com
233 B
1 sharedid.org
id.sharedid.org
213 B
1 truste.com
choices.truste.com
10 KB
1 id5-sync.com
id5-sync.com
532 B
1 t.co
t.co
470 B
1 twitter.com
analytics.twitter.com
674 B
1 quantcount.com
rules.quantcount.com
354 B
1 ipify.org
geo.ipify.org
554 B
1 ads-twitter.com
static.ads-twitter.com
6 KB
1 googletagmanager.com
www.googletagmanager.com
59 KB
0 tempsyncurl.com Failed
tempsyncurl.com Failed
566 105
Domain Requested by
34 rtb.gumgum.com 1 redirects ap.lijit.com
rtb.gumgum.com
g2.gumgum.com
33 cm.g.doubleclick.net 23 redirects googleads.g.doubleclick.net
u.openx.net
ap.lijit.com
eb2.3lift.com
rtb.gumgum.com
g2.gumgum.com
24 pagead2.googlesyndication.com srcdoc
securepubads.g.doubleclick.net
tpc.googlesyndication.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
tagan.adlightning.com
www.googletagservices.com
20 assets.threatpost.com threatpost.com
assets.threatpost.com
19 tpc.googlesyndication.com tagan.adlightning.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
18 dsum-sec.casalemedia.com 5 redirects googleads.g.doubleclick.net
ssum-sec.casalemedia.com
17 ce.lijit.com 1 redirects ap.lijit.com
rtb.gumgum.com
17 ib.adnxs.com 4 redirects cds.connatix.com
qd.admetricspro.com
acdn.adnxs.com
googleads.g.doubleclick.net
16 capi.connatix.com cd.connatix.com
15 threatpost.com threatpost.com
14 x.bidswitch.net 13 redirects eb2.3lift.com
14 pr.ybp.yahoo.com acdn.adnxs-simple.com
14 s0.2mdn.net imasdk.googleapis.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
tagan.adlightning.com
s0.2mdn.net
12 us-u.openx.net 4 redirects googleads.g.doubleclick.net
u.openx.net
eu-u.openx.net
ap.lijit.com
12 match.adsrvr.org 6 redirects u.openx.net
ssum-sec.casalemedia.com
eb2.3lift.com
11 tagan.adlightning.com threatpost.com
tagan.adlightning.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
10 ams1-ib.adnxs.com 1 redirects cdn.adnxs.com
10 ads.servenobid.com qd.admetricspro.com
ap.lijit.com
public.servenobid.com
ssum-sec.casalemedia.com
g2.gumgum.com
ssbsync.smartadserver.com
10 media.threatpost.com threatpost.com
9 sync.mathtag.com 9 redirects
9 ads.pubmatic.com cds.connatix.com
ads.pubmatic.com
qd.admetricspro.com
ap.lijit.com
rtb.gumgum.com
g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
9 vid.connatix.com cd.connatix.com
8 sync.1rx.io 8 redirects
8 eus.rubiconproject.com qd.admetricspro.com
eus.rubiconproject.com
rtb.gumgum.com
g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
8 ssum-sec.casalemedia.com 1 redirects js-sec.indexww.com
ssum-sec.casalemedia.com
public.servenobid.com
8 googleads.g.doubleclick.net 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
tagan.adlightning.com
8 www.google.com 1 redirects threatpost.com
tagan.adlightning.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
7 match.prod.bidr.io 5 redirects eu-u.openx.net
ssum-sec.casalemedia.com
7 eb2.3lift.com 2 redirects qd.admetricspro.com
eb2.3lift.com
7 secure.adnxs.com 4 redirects ssum-sec.casalemedia.com
7 s.amazon-adsystem.com 3 redirects ssum-sec.casalemedia.com
eb2.3lift.com
ssbsync.smartadserver.com
7 eu-u.openx.net u.openx.net
qd.admetricspro.com
eu-u.openx.net
7 googleads4.g.doubleclick.net googleads.g.doubleclick.net
threatpost.com
7 ups.analytics.yahoo.com 3 redirects ssum-sec.casalemedia.com
7 e.serverbid.com 2 redirects qd.admetricspro.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
7 qd.admetricspro.com threatpost.com
qd.admetricspro.com
6 creativecdn.com 6 redirects
6 pr-bh.ybp.yahoo.com 3 redirects eu-u.openx.net
ssum-sec.casalemedia.com
6 c1.adform.net 5 redirects ads.pubmatic.com
6 js-sec.indexww.com cds.connatix.com
ssum-sec.casalemedia.com
qd.admetricspro.com
6 ap.lijit.com 3 redirects qd.admetricspro.com
ap.lijit.com
6 pixel.quantserve.com 5 redirects threatpost.com
6 securepubads.g.doubleclick.net tagan.adlightning.com
www.googletagservices.com
securepubads.g.doubleclick.net
imasdk.googleapis.com
5 rtb-csync.smartadserver.com 2 redirects ssbsync.smartadserver.com
5 yahoovpaidtwoint215831825037.s.moatpixel.com
5 p.rfihub.com 5 redirects
5 pixel.advertising.com 5 redirects
5 sync-tm.everesttech.net 4 redirects ssum-sec.casalemedia.com
5 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com securepubads.g.doubleclick.net
tagan.adlightning.com
5 tag.1rx.io cds.connatix.com
qd.admetricspro.com
5 www.googletagservices.com threatpost.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
4 ad.360yield.com 4 redirects
4 sync.outbrain.com 3 redirects rtb.gumgum.com
4 b1sync.zemanta.com 4 redirects
4 pool.admedo.com 4 redirects
4 sync.targeting.unrulymedia.com 4 redirects
4 ade.googlesyndication.com
4 sync.teads.tv googleads.g.doubleclick.net
4 acdn.adnxs.com acdn.adnxs-simple.com
cds.connatix.com
qd.admetricspro.com
4 adservice.google.com imasdk.googleapis.com
tagan.adlightning.com
4 fastlane.rubiconproject.com qd.admetricspro.com
4 imasdk.googleapis.com cd.connatix.com
imasdk.googleapis.com
4 www.gstatic.com www.google.com
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
4 c.amazon-adsystem.com qd.admetricspro.com
c.amazon-adsystem.com
3 pixel.rubiconproject.com rtb.gumgum.com
3 cs.emxdgt.com rtb.gumgum.com
g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
3 secure-assets.rubiconproject.com 3 redirects
3 choices.trustarc.com tagan.adlightning.com
3 match.deepintent.com rtb.gumgum.com
ssum-sec.casalemedia.com
g2.gumgum.com
3 ad.turn.com 3 redirects
3 sync.go.sonobi.com public.servenobid.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
3 ssbsync.smartadserver.com public.servenobid.com
rtb.gumgum.com
g2.gumgum.com
3 px.owneriq.net 2 redirects ap.lijit.com
3 bh.contextweb.com 3 redirects
3 image2.pubmatic.com ads.pubmatic.com
3 c2shb.ssp.yahoo.com qd.admetricspro.com
3 btlr.sharethrough.com qd.admetricspro.com
3 prebid.a-mo.net 1 redirects cds.connatix.com
qd.admetricspro.com
3 hbopenbid.pubmatic.com cds.connatix.com
qd.admetricspro.com
3 teachingaids-d.openx.net cds.connatix.com
qd.admetricspro.com
3 htlb.casalemedia.com cds.connatix.com
qd.admetricspro.com
3 img.connatix.com threatpost.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
threatpost.com
3 cds.connatix.com threatpost.com
cd.connatix.com
2 i.liadm.com 2 redirects
2 token.rubiconproject.com
2 tg.socdm.com 2 redirects
2 ssc-cms.33across.com rtb.gumgum.com
g2.gumgum.com
2 sync.technoratimedia.com rtb.gumgum.com
g2.gumgum.com
2 sync.ipredictive.com 2 redirects
2 ads.creative-serving.com 2 redirects
2 sync.srv.stackadapt.com 2 redirects
2 aax-eu.amazon-adsystem.com 1 redirects ap.lijit.com
2 jadserve.postrelease.com ap.lijit.com
public.servenobid.com
2 bcp.crwdcntrl.net 2 redirects
2 pixel-us-east.rubiconproject.com ap.lijit.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
2 rtb.mfadsrvr.com 2 redirects
2 ads.avct.cloud 2 redirects
2 pm.w55c.net 2 redirects
2 ums.acuityplatform.com 2 redirects
2 beacon.lynx.cognitivlabs.com 2 redirects
2 bttrack.com ssum-sec.casalemedia.com
2 simage2.pubmatic.com ads.pubmatic.com
2 um.simpli.fi 1 redirects ads.pubmatic.com
2 loada.exelator.com 2 redirects
2 pixel.onaudience.com 1 redirects ads.pubmatic.com
2 d5p.de17a.com 2 redirects
2 u.openx.net cds.connatix.com
2 fonts.googleapis.com 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
2 s.yimg.com acdn.adnxs-simple.com
2 pubads.g.doubleclick.net imasdk.googleapis.com
2 prebid.adnxs.com cds.connatix.com
cd.connatix.com
2 mug.criteo.com threatpost.com
2 gum.criteo.com 1 redirects
2 script.4dex.io qd.admetricspro.com
script.4dex.io
2 kasperskycontenthub.com threatpost.com
1 beap-bc.yahoo.com s.yimg.com
1 simage4.pubmatic.com ads.pubmatic.com
1 i6.liadm.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 gift-connect-d.openx.net serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 go.sonobi.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 ads.yahoo.com
1 id.rlcdn.com
1 dsp.nrich.ai 1 redirects
1 stags.bluekai.com 1 redirects
1 ad4m.at ssum-sec.casalemedia.com
1 dmp.brand-display.com ssum-sec.casalemedia.com
1 sync.hgrtb.com 1 redirects
1 dsum.casalemedia.com ssum-sec.casalemedia.com
1 casale-match.dotomi.com 1 redirects
1 c.bing.com eb2.3lift.com
1 px.ads.linkedin.com eb2.3lift.com
1 t.adx.opera.com public.servenobid.com
1 onetag-sys.com public.servenobid.com
1 pixel.33across.com public.servenobid.com
1 g2.gumgum.com public.servenobid.com
1 d.turn.com 1 redirects
1 aorta.clickagy.com 1 redirects
1 contextual.media.net ap.lijit.com
1 data.adsrvr.org ap.lijit.com
1 pixel-sync.sitescout.com 1 redirects
1 pixel-eu.rubiconproject.com ap.lijit.com
1 rtb.openx.net eu-u.openx.net
1 public.servenobid.com qd.admetricspro.com
1 serverbid-sync.nyc3.cdn.digitaloceanspaces.com qd.admetricspro.com
1 sync.serverbid.com 1 redirects
1 cdn.adnxs.com tagan.adlightning.com
1 nep.advangelists.com 1 redirects
1 image4.pubmatic.com ads.pubmatic.com
1 image6.pubmatic.com ads.pubmatic.com
1 mb.moatads.com z.moatads.com
1 geo.moatads.com z.moatads.com
1 id.sharedid.org cds.connatix.com
1 r3---sn-aigzrne7.c.2mdn.net
1 gcdn.2mdn.net 1 redirects
1 z.moatads.com s.yimg.com
1 choices.truste.com 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
1 bid.g.doubleclick.net 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
1 ad.doubleclick.net s.yimg.com
1 rb.adnxs-simple.com acdn.adnxs-simple.com
1 acdn.adnxs-simple.com cd.connatix.com
1 adservice.google.co.uk tagan.adlightning.com
1 tlx.3lift.com qd.admetricspro.com
1 mp.4dex.io qd.admetricspro.com
1 www.google.co.uk threatpost.com
1 ads.adaptv.advertising.com cds.connatix.com
1 id5-sync.com qd.admetricspro.com
1 stats.g.doubleclick.net www.google-analytics.com
1 t.co threatpost.com
1 analytics.twitter.com tagan.adlightning.com
1 rules.quantcount.com secure.quantserve.com
1 lit.connatix.com cd.connatix.com
1 geo.ipify.org qd.admetricspro.com
1 static.ads-twitter.com www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 www.googletagmanager.com threatpost.com
1 cd.connatix.com 1 redirects
0 tempsyncurl.com Failed g2.gumgum.com
566 178
Subject Issuer Validity Valid
threatpost.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-07-03		 a year crt.sh
*.adlightning.com
Amazon		 2021-06-24 -
2022-07-23		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-08-11 -
2022-08-10		 a year crt.sh
assets.threatpost.com
Amazon		 2021-02-04 -
2022-03-05		 a year crt.sh
media.threatpost.com
Amazon		 2021-02-04 -
2022-03-05		 a year crt.sh
www.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
kasperskycontenthub.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-07-03		 a year crt.sh
c.amazon-adsystem.com
Amazon		 2021-07-06 -
2022-06-27		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2021-08-20 -
2022-09-21		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-21 -
2022-07-26		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2021-01-19 -
2022-02-19		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-31 -
2022-10-30		 a year crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2021-01-12 -
2022-01-11		 a year crt.sh
*.id5-sync.com
R3		 2021-10-05 -
2022-01-03		 3 months crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-09 -
2021-12-07		 3 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
*.1rx.io
Sectigo RSA Domain Validation Secure Server CA		 2021-06-01 -
2022-07-02		 a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2021-08-04 -
2022-09-04		 a year crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-19 -
2022-04-13		 6 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2021-03-05 -
2022-02-19		 a year crt.sh
*.a-mo.net
R3		 2021-10-05 -
2022-01-03		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
www.google.co.uk
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
e.serverbid.com
R3		 2021-10-22 -
2022-01-20		 3 months crt.sh
*.sharethrough.com
Amazon		 2021-08-13 -
2022-09-11		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-14 -
2022-04-06		 6 months crt.sh
*.3lift.com
Amazon		 2021-06-12 -
2022-07-11		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-04		 a year crt.sh
ads.servenobid.com
Amazon		 2021-06-28 -
2022-07-27		 a year crt.sh
prebid.adnxs.com
GeoTrust TLS RSA CA G1		 2020-03-29 -
2022-03-29		 2 years crt.sh
*.google.co.uk
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
cdn.adnxs.com
GlobalSign Organization Validated CA - SHA256 - G4		 2021-05-10 -
2022-06-11		 a year crt.sh
*.adnxs-simple.com
GeoTrust RSA CA 2018		 2021-03-17 -
2022-03-15		 a year crt.sh
*.api.fantasysports.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-11-08 -
2021-12-29		 2 months crt.sh
*.truste.com
Amazon		 2021-02-16 -
2022-03-17		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2021-01-21 -
2022-01-25		 a year crt.sh
id.sharedid.org
Amazon		 2021-01-08 -
2022-02-06		 a year crt.sh
*.moatads.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-25 -
2022-06-25		 a year crt.sh
teads.tv
R3		 2021-11-03 -
2022-02-01		 3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
*.simpli.fi
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-27 -
2022-11-27		 a year crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA		 2021-03-29 -
2022-03-29		 a year crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-08-17 -
2022-02-09		 6 months crt.sh
*.nyc3.cdn.digitaloceanspaces.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-30		 a year crt.sh
public.servenobid.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-22 -
2022-05-22		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-08-24 -
2022-02-16		 6 months crt.sh
*.media.net
DigiCert SHA2 Secure Server CA		 2021-04-12 -
2022-04-20		 a year crt.sh
*.postrelease.com
Amazon		 2021-01-28 -
2022-02-25		 a year crt.sh
*.gumgum.com
Amazon		 2021-06-05 -
2022-07-04		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
onetag-sys.com
R3		 2021-11-02 -
2022-01-31		 3 months crt.sh
*.smartadserver.com
DigiCert ECC Secure Server CA		 2020-01-30 -
2022-02-03		 2 years crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2020-12-06 -
2022-01-07		 a year crt.sh
*.adx.opera.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-14 -
2022-06-10		 a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2021-09-16 -
2022-03-16		 6 months crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2020-04-23 -
2022-05-04		 2 years crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2021-09-30 -
2022-03-30		 6 months crt.sh
*.everesttech.net
GlobalSign Atlas R3 DV TLS CA 2020		 2021-03-22 -
2022-04-23		 a year crt.sh
*.technoratimedia.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-17 -
2022-10-05		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.trustarc.com
Go Daddy Secure Certificate Authority - G2		 2020-05-21 -
2022-07-17		 2 years crt.sh
*.match.prod.bidr.io
Amazon		 2021-02-26 -
2022-03-27		 a year crt.sh
*.brand-display.com
GeoTrust RSA CA 2018		 2020-06-24 -
2022-06-24		 2 years crt.sh
*.emxdgt.com
Go Daddy Secure Certificate Authority - G2		 2021-05-18 -
2022-06-19		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh

This page contains 87 frames:

Primary Page: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Frame ID: F656E6DC87791F5E53C3308AF8779FF2
Requests: 132 HTTP requests in this frame

Frame: https://cds.connatix.com/p/140482/connatix.player.dc.js
Frame ID: 42CC778B1AFF64C760FFFC97E46B259D
Requests: 36 HTTP requests in this frame

Frame: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Frame ID: E95F3F6C375E2E3DB947D9BBBC10C163
Requests: 21 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Frame ID: E344351A76DAC08D8D43B24844EEFD63
Requests: 2 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Frame ID: DED07D9B377910D9C7F47B168A337792
Requests: 2 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Frame ID: 8D1A80CB718ED1D6624FD1C3545749ED
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 24EC5646EA66475D41BC07225C488011
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 2AA8DA535F461C97240771096E3E982B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: C7E5110F9A018A4CC28DDDF1BE3ED772
Requests: 1 HTTP requests in this frame

Frame: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: CF2F01481D40E10707AEAA52D4D21065
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs-simple.com/vx/static/w/anwrapper-1.999.0.js
Frame ID: E7CBEF9DDF407AA2F7360E6173D5B9A8
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 357DDC3657723727A287FAC79390FF18
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 98D52F4B86F1291C30C0CCE40752CA7A
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 627E70A9F93FC0BD8636C64EEBCFD6E0
Requests: 3 HTTP requests in this frame

Frame: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B8A1E32AE15E2B88AAB5606B4CF759FE
Requests: 17 HTTP requests in this frame

Frame: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 41156EC48B74D538C9436C11AFFB6028
Requests: 17 HTTP requests in this frame

Frame: https://s.yimg.com/ff/vista.js
Frame ID: 1A0D57AD984F4A599618E9BB77997A23
Requests: 19 HTTP requests in this frame

Frame: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 2AD8D68B1F9F76E329FCCD98C8681732
Requests: 22 HTTP requests in this frame

Frame: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 46DFA8572202BD77F3CABCE52FB79724
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY2pakvAEwAQ&v=APEucNUVygIjliIkBwdyFJgFaGqPmjom6tJTRcnXT7GkD8yBdmU5jtsbd0Gktuv9ZjewpMMNl7lC_E-BtM-JLx0f9uuC96GKXjgKoS0XeOP70BI71pb1vX4
Frame ID: 7B840B2BFF2B906D2823EB2632627E40
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY1Y2kvAEwAQ&v=APEucNXKtfKkZpJagbbEl7SbK6_S-awmAfb1eW1UD08aeVVJ-GBEUTZemE_B_22dyJWspvDlKEegBoj0eWVTRx23FbB2lhhm-kh115Y9uih8HN4Rcw7hpYU
Frame ID: 959A8CC9409A5639D8F16DB1203CC3C0
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-Ahj8rcu5ATAB&v=APEucNUPKKdaNb2UqW5LdOMpf9CTTewVMlTAPPffIgjnUYK6822T2BfKUVplvDXZRLh7c-GRbr92qaChMo-XclzKrK4DFIUypnFj79g8oTEiy67UrAo-kFQ
Frame ID: 665D5456C670FA4182611B131E89ED60
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 41197FC6DF0AE1B2EED47D4AD18B6E26
Requests: 7 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: FBFFD81EB41F857F647A53800D9817BA
Requests: 11 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: 0BAE249309FD72343569E66825FC894E
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 1AA39F5B13E1545DEA8BDA4309898AD3
Requests: 3 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: C6D3237E7308926C12453E66B51DF5CD
Requests: 7 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: D0F34357978E6788BB295F973BE305E6
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: E4179E257ECA16B384B738E3F8F79A38
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 55BE2B1BE566EC14ED9A868F79F890D2
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: AA2CDE1A06B761FEF8EA107873E89788
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 8A2BC267D495E3DE13EA26D051E6853C
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 6B6B594E86270C60C4DDE8D08389C671
Requests: 3 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: E9259CA3AD68643A5344961FC1B97D8E
Requests: 10 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: B9CF3E268CD1CD9FA15971A07F646EAB
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A5DDB17EF6E23549206B1904938CB9A6
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/10774078/1635808046742/index.html
Frame ID: 8E82832D6E181ECF45F0902EE0D6787B
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 37C28AAE4FAEB39771A276EA30A612FC
Requests: 3 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?party=14&cid=E461FCB8-9678-4565-B13D-1B260BE3F7B9
Frame ID: D6336244DEF43C3C01CE3344D5E51D98
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1361929279369711967
Frame ID: E28BE609EB3AC2E3F6562B555B4085F0
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 3D5A1F32E843C5D26205F0F588FBC47F
Requests: 8 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 84C7A846883463AC5FA04A6309282FFE
Requests: 9 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 2D20C12268B9A635B6E3A637194B8E06
Requests: 3 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 8E645C7CB365A7927F2CE66E18F61004
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: F801107E9BC8D76618957449B547411F
Requests: 7 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: A84E3C5CEE5A3544691D1E2C57A7CF23
Requests: 11 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 87B030CBAA92D59D1E996E70D215A37F
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 3EA4BE5F865E4915D8C319D7597BA893
Requests: 10 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437
Frame ID: 77AC17397EF7F77FC9CE602406C1BAA7
Requests: 25 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: AB17AB7D8BDC5D435A75E59614D894CA
Requests: 10 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=
Frame ID: 46C129B57B60CA0BC07272143E9C188C
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Frame ID: B9883253652F10F3DAE4902F74BACAE2
Requests: 1 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Frame ID: D93F7A68ED4C4F8F8AA2658901202093
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Frame ID: 9CD56A288D477DE8215578E83F760B75
Requests: 16 HTTP requests in this frame

Frame: https://ce.lijit.com/merge?pid=1&3pid=3239295199777413054&gdpr=0&gdpr_consent=
Frame ID: 9A7A26E8AA10CC1FFE73200B64244408
Requests: 1 HTTP requests in this frame

Frame: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Frame ID: F9C635BEF2D06B1D44878826950C1A19
Requests: 16 HTTP requests in this frame

Frame: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Frame ID: A605A5C6C33078EDEDC391D3208A865C
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Frame ID: D4982F38E9ABA240FBADAB75031C6FCA
Requests: 1 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Frame ID: D37AD6869E2288283F6D5299A4371A90
Requests: 6 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Frame ID: B3377AC335014906ADD0F460E8296F69
Requests: 10 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: 57753465D72C93BE2FCC47D1355352D8
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
Frame ID: 5B196212ECED95C5D0815115B773CD9E
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 27F642C2B04CE44642B2903FF25AD84B
Requests: 3 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Frame ID: 6BA311187F8BCF9AA5A3667CAD561295
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
Frame ID: 75F3050FB855E987C3A911127EADD1E8
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9hNjQ1MmQyMy01Y2UyLTQ3OWUtYjkxZC0xZjBiNjZmODA1MTM=&gdpr=0&gdpr_consent=
Frame ID: A0C7C0641341432C742C062BB9EC5861
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Frame ID: 9DEF5824BE365F82DCAC01FB9585FD1E
Requests: 1 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Frame ID: 356A213F349EBA4867FA524DEA897AF5
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5ukAAKqmDKkAAAAA
Frame ID: DF6D9DC88A29B97D64CDDB7BB811435C
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Frame ID: 19F428ECC6B42D0C4E1D6F67ACEB9046
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
Frame ID: 0581259F49029597D6006ADC4853CF47
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: 2965FA3FBD2EF58AA4C7845AF13FCA32
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
Frame ID: 6DD9BBC87AB3AFB897AF86762CD668DD
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: C7AC7F4148CCC7CB45265D7CE12FB8F0
Requests: 2 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Frame ID: 1990668E809361EEA2744F4F41A08BA3
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
Frame ID: 4C9C22BE4F7434D56265031226D6A44C
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV81OTNlMGY1Ni01N2YyLTQzN2QtOGQ1OS04YWRkNmI3NzlmZmM=&gdpr=0&gdpr_consent=
Frame ID: B7062F3DD5CAB096DBFB25132AE6B7D3
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Frame ID: B8A8739A9D842E817F77F8FE7341D65F
Requests: 1 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Frame ID: AA6E9130C7E493BAF4026AD8AB23ADB4
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5sAAAFxkJAUAAAAA
Frame ID: 744FE1FACCBE5A5FA66C89550D1873F5
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Frame ID: EEA6BA5042E4C8F97D77DAF074A32CD5
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
Frame ID: 09C09B61F0CBB89BFA993C87E893E40C
Requests: 1 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Frame ID: 23764053D20193A10398C01171FE7B2E
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Frame ID: 9937CE4E17124597B309D872027321B3
Requests: 3 HTTP requests in this frame

Frame: https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Frame ID: 715F64CCA020207C7ABBF60A9E7F5A3F
Requests: 1 HTTP requests in this frame

Frame: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Frame ID: 2DAD43D18737B2F3C0145BA320048032
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Frame ID: BB47C0CC7C5B9A76410C320002F97C8E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

IKEA Hit by Email Reply-Chain Cyberattack | Threatpost

Page Statistics

566
Requests

78 %
HTTPS

23 %
IPv6

105
Domains

178
Subdomains

124
IPs

12
Countries

18052 kB
Transfer

25261 kB
Size

145
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31
  • https://cd.connatix.com/connatix.player.js HTTP 302
  • https://cds.connatix.com/p/140482/connatix.player.dc.js
Request Chain 99
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=F8xJlnxBUDZtZ2RxbnB1dkptYmFEREtMUkc1ak1NWmpzRnltdjk4UlhmWmF6eDJFTUNXMXg4QzRmOCtWaWYyVERGT2R0d0xhM3ZiWi9qdjllSDluVVRrMUNTVzJPQXlqald6elRIQk5mMVlsbHVoS0YzdkxEbDJZbWF0U0VxaS9pMC9ZdHcyckY4QWZnUGlGMmVzWGcwV29DTnpwcDFxdFhEVzA5aVFNNC9kS1JxaHYrOUlobEJsalA3MU1ydCtWTEVmb2xsODRqUTZKNDBTVEQyTS92UjdXWG14OHpkbXB5YU41VllSQ0x0Zzg5d3NVPXw&cppv=2
Request Chain 163
  • https://ams1-ib.adnxs.com/vast_track/v2?info=agAAAAMArgAFAQkK6qVhAAAAABFN2FLvE44pehkJ6qVhAAAAACCU5e6SASgAMJ8XOOc3QMyyYUjD6pcCUJ-ZpQhYvY0HYgJHQmgBcAF4AIABAogBAZABkAOYAeEBoAEAqAGU5e6SAbABAQ..&s=7c5eb20315d533ef6dec8ea58f0da25caec2c6b6&event_type=1&redir=https%3A%2F%2Fams1-ib.adnxs.com%2Fab%3Fro%3D1%26an_audit%3D0%26referrer%3Dhttps%253A%252F%252Fthreatpost.com%252Fikea-email-reply-chain-attack%252F176625%252F%26e%3DwqT_3QKLEugLCQAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9iOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SACkRJNgxAAAA4HoU_j8wn5mlCDjnN0CfF0i3AVCU5e6SAVjLj3pgAGjnpakBeLKQBYABAYoBA1VTRJIBAQb0hAiYAQGgAQGoAQGwAQC4AQPAAQXIAQLQAQDYAQDgAQDwAQDYAtNH4ALX9zfqAjxodHRwczovL3RocmVhdHBvc3QuY29tL2lrZWEtZW1haWwtcmVwbHktY2hhaW4tYXR0YWNrLzE3NjYyNS_yAoMNCghJTVBfREFUQRL2DGhCMVRoWmNHLUpRN0lKc1Z2aUs5TkdxanRPTm9hR2Z1T2hOSkhKVHMyaEJXX0lEdmNEN3N6dTNpRUw0cjV5UXdDdHR4Zl9WTC1jNE95b3lNYy1qZGVyZ1ExX2IxZXFJS0JmcURFVk1uYlBmQjFjb0xWRDhLOHlsS1dpaWVsMXlIdmxXdEZNREN1NXlaRlBIaDdPaEZfOE1tNG1Gdk9tQ2R0LUFXdHVYWThGSjZ6YWdIMDI0YVRCeEdsYmhaWTB4S0RPNjB3QURsUlBQU2V2c3I0QlZHakx0eldpZC1HamhTRzJwYXNCallvQVpWUm42VG5IbkgxZ3JRbHlBc3RWdnltbFNKbktEWjgxU1ZGQ2paRG5jdV9lWk90Tmcta1BlWUlXUEdhMTlxczdVYVY0WDJQYXdXaERmSHhDR2s4NWtmT3JuTm5GcW5DSXhZdmE3Y1kwRndLUVg4REFKQ1lBSkM2Z1UxdVN0ZnktenVFQ2ZabHNBR0F2UDJGUW8wazhXVWtJSDExUVFOYVhUSUZSam1RbFhULTlxRzJROFdPVHBVSDZwNkhhQ2QyNFFDUHJJWFBna3B2ZDNROGtTdEVUb21tLUY3ZHplTUU0MWtSeGl0dGtOZExyeVpTYTVjM2JPUmNzeURzSEk3bldoWVlhVHV5YWJ4cVhKUXIxeDRVd0h3cEJoV1RuTzR4QnIxX211MFBfcmxmRVpoZmdZQkRDeFZUVk1TQm5LMWwzTnBYdHNfWWE2LWRqcTF0eTNISERna29xSWJ4RklVbzZDbnMyZ2dwRjFWWnBuMndiV3FfLUZ2X3dabGVzazVmY2pYckMwazBPQWdWNExTRmd2U3luUUMyVFhvaXAteVEyQkVBNzdodF9GdWxvdFRFR1AtSG1mUTQ5S0QwTllwdjlORDBXR2ZJN2kwZ0lWVVdqWnhZTjZWSnRaTFJzaHJpUUJrLVJGLU1KZURrcHV4Y21xbUcyaVRtbnpBQzF4RGxpQ2xScDV3OVpNNldFNDlyS044MzJuTkVicGFiSzM0WERhXzR5Y3hSdlJhTmE4T0prNlJpNU4xX21NajRmZVVCX2dnNmliQ3JVbGpQSmUwdlcyd2xrZHMxLU1ONVhxaExIMGMzUkZyZnZzazZfX2Y1RzdBYnp6YU8tTXhMRUh4M2E0TlNrYzlxVkJvTVhyMXYyZFhiWGVsN01xOFJaZXF0Mno2dmJyT3FLN1VrN1had3QzZmpMN0s1ZjEyUnVYVkhjREZ0Z2dJMVBVUWFTUWhvX01pd0lGdkpLeHFUeFRjRHFVY1RURHpyOUdMYk1WNmtKcG4zWC16aTVORHZQRmxZaXM2OUZpV3lpejVFdUF5VUhmR04yMUx4RG5KbjdfdHZWb18xLW9PejJqUzJHX285MXN5bzRzeWZlcW1HUzFoM1ZGWGFtTHZ4aXcyNG51MTVieUExeF9IRlBhWWoyOGFrWV9rMjVOSGpuLXc3VG1ldkpQeHRRQmFwMlVBOWZrWmZlX2xocV9iUnctNDVrRHJXeGxoeUQwS3BxVC00a3ZsWXpqQzJvVTBkUEVTWVZHV2hCM0ZvaTdqSEgxRkN4SU1wRkQ4NlJ4T0ZQaUhuOS1tb1dCXzRNOXV0ejlvR1EwbFM1UmpINTJUc2lEUGdnQ0ZiRFYzR3JzOW1fSTZEUmFtbXEyM043MjRrZE1pMzNvSnNQZnAtU1ZpLWw5UFYtbGl0dXRPb24tWVBFZy11ZktLbWo4a1Q2UXJKbnNtakg3TlpQVVlweW51MEd4czdpcG1RckdPU2tncXRyMjE5cDRuYnp2S0JYQ3NCODRoeEFvbHNFd01mbF9BTFlFeFlNbk1TWWZzeWpuZVR1WGZSdnRMWmtBVGNPM1VNaXJYVnBjaUNNRHk5d055M2VzTHhMNzdtQWxjZkF2YWpvMThBNk1WMDlpYm5FRDRDRUxYcC1GSFQ3ajUxcG9FS3hsV0hxRHVobzBmTXlMZWVrWG9uY2prano1TUhYd0V1SzdqX3ZwX1VDajR0SGNaTlZfSTRvSDJkTnJKVVhoU0Iwa21vcmxVZ3NEUGxMbkowaHM2NGY3dWdiLU5rb1h0SElCREZ5SUNqMzdFN0tOaWE5MmdEN1UtaXpmc0l2azRBdUJ6SGVDM25TOHlJVHVaQXdMOUIzdS14RnAwNVBYNVhrN1N0VGVlLTdaR1hxZUxaanRJeXeAAwCIAwGQAwCYAxegAwGqA00SEzEzNjIyODc4OTk1Nzk5ODQ2NTEaEzg4MDI3MjMxNjI5NDMwNTE4NTMiCTMwNzk5OTM4MCoNT0FUSDEwMTcwMDAwMDoHMzY1MTU1N8AD4KgByAMA2AO21bcB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjg5LjIzOC4xNDIuMjE1qAQAsgQQCAEQBBiQAyDhASgCMAA4A7gEAMAEAMgEANoEAggB4AQA8ASU5e6SAYgFAZgFAKAF7qfdod-3k6kfwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFvY0H-gUECAAQAJAGAZgGALgGAMEGAAAAAAAA8D_QBuS_AdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgTyBgIIAIAHAYgHAKAHQKoHBzE3OTk2NzK6Bw8IABAAGAAgADAAOKIKQADIB7KQBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHw9ZkiggCEAA.%26s%3D73966e40153798b0262f47af21c5c9686d992884 HTTP 302
  • https://ams1-ib.adnxs.com/ab?ro=1&an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QKLEugLCQAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9iOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SACkRJNgxAAAA4HoU_j8wn5mlCDjnN0CfF0i3AVCU5e6SAVjLj3pgAGjnpakBeLKQBYABAYoBA1VTRJIBAQb0hAiYAQGgAQGoAQGwAQC4AQPAAQXIAQLQAQDYAQDgAQDwAQDYAtNH4ALX9zfqAjxodHRwczovL3RocmVhdHBvc3QuY29tL2lrZWEtZW1haWwtcmVwbHktY2hhaW4tYXR0YWNrLzE3NjYyNS_yAoMNCghJTVBfREFUQRL2DGhCMVRoWmNHLUpRN0lKc1Z2aUs5TkdxanRPTm9hR2Z1T2hOSkhKVHMyaEJXX0lEdmNEN3N6dTNpRUw0cjV5UXdDdHR4Zl9WTC1jNE95b3lNYy1qZGVyZ1ExX2IxZXFJS0JmcURFVk1uYlBmQjFjb0xWRDhLOHlsS1dpaWVsMXlIdmxXdEZNREN1NXlaRlBIaDdPaEZfOE1tNG1Gdk9tQ2R0LUFXdHVYWThGSjZ6YWdIMDI0YVRCeEdsYmhaWTB4S0RPNjB3QURsUlBQU2V2c3I0QlZHakx0eldpZC1HamhTRzJwYXNCallvQVpWUm42VG5IbkgxZ3JRbHlBc3RWdnltbFNKbktEWjgxU1ZGQ2paRG5jdV9lWk90Tmcta1BlWUlXUEdhMTlxczdVYVY0WDJQYXdXaERmSHhDR2s4NWtmT3JuTm5GcW5DSXhZdmE3Y1kwRndLUVg4REFKQ1lBSkM2Z1UxdVN0ZnktenVFQ2ZabHNBR0F2UDJGUW8wazhXVWtJSDExUVFOYVhUSUZSam1RbFhULTlxRzJROFdPVHBVSDZwNkhhQ2QyNFFDUHJJWFBna3B2ZDNROGtTdEVUb21tLUY3ZHplTUU0MWtSeGl0dGtOZExyeVpTYTVjM2JPUmNzeURzSEk3bldoWVlhVHV5YWJ4cVhKUXIxeDRVd0h3cEJoV1RuTzR4QnIxX211MFBfcmxmRVpoZmdZQkRDeFZUVk1TQm5LMWwzTnBYdHNfWWE2LWRqcTF0eTNISERna29xSWJ4RklVbzZDbnMyZ2dwRjFWWnBuMndiV3FfLUZ2X3dabGVzazVmY2pYckMwazBPQWdWNExTRmd2U3luUUMyVFhvaXAteVEyQkVBNzdodF9GdWxvdFRFR1AtSG1mUTQ5S0QwTllwdjlORDBXR2ZJN2kwZ0lWVVdqWnhZTjZWSnRaTFJzaHJpUUJrLVJGLU1KZURrcHV4Y21xbUcyaVRtbnpBQzF4RGxpQ2xScDV3OVpNNldFNDlyS044MzJuTkVicGFiSzM0WERhXzR5Y3hSdlJhTmE4T0prNlJpNU4xX21NajRmZVVCX2dnNmliQ3JVbGpQSmUwdlcyd2xrZHMxLU1ONVhxaExIMGMzUkZyZnZzazZfX2Y1RzdBYnp6YU8tTXhMRUh4M2E0TlNrYzlxVkJvTVhyMXYyZFhiWGVsN01xOFJaZXF0Mno2dmJyT3FLN1VrN1had3QzZmpMN0s1ZjEyUnVYVkhjREZ0Z2dJMVBVUWFTUWhvX01pd0lGdkpLeHFUeFRjRHFVY1RURHpyOUdMYk1WNmtKcG4zWC16aTVORHZQRmxZaXM2OUZpV3lpejVFdUF5VUhmR04yMUx4RG5KbjdfdHZWb18xLW9PejJqUzJHX285MXN5bzRzeWZlcW1HUzFoM1ZGWGFtTHZ4aXcyNG51MTVieUExeF9IRlBhWWoyOGFrWV9rMjVOSGpuLXc3VG1ldkpQeHRRQmFwMlVBOWZrWmZlX2xocV9iUnctNDVrRHJXeGxoeUQwS3BxVC00a3ZsWXpqQzJvVTBkUEVTWVZHV2hCM0ZvaTdqSEgxRkN4SU1wRkQ4NlJ4T0ZQaUhuOS1tb1dCXzRNOXV0ejlvR1EwbFM1UmpINTJUc2lEUGdnQ0ZiRFYzR3JzOW1fSTZEUmFtbXEyM043MjRrZE1pMzNvSnNQZnAtU1ZpLWw5UFYtbGl0dXRPb24tWVBFZy11ZktLbWo4a1Q2UXJKbnNtakg3TlpQVVlweW51MEd4czdpcG1RckdPU2tncXRyMjE5cDRuYnp2S0JYQ3NCODRoeEFvbHNFd01mbF9BTFlFeFlNbk1TWWZzeWpuZVR1WGZSdnRMWmtBVGNPM1VNaXJYVnBjaUNNRHk5d055M2VzTHhMNzdtQWxjZkF2YWpvMThBNk1WMDlpYm5FRDRDRUxYcC1GSFQ3ajUxcG9FS3hsV0hxRHVobzBmTXlMZWVrWG9uY2prano1TUhYd0V1SzdqX3ZwX1VDajR0SGNaTlZfSTRvSDJkTnJKVVhoU0Iwa21vcmxVZ3NEUGxMbkowaHM2NGY3dWdiLU5rb1h0SElCREZ5SUNqMzdFN0tOaWE5MmdEN1UtaXpmc0l2azRBdUJ6SGVDM25TOHlJVHVaQXdMOUIzdS14RnAwNVBYNVhrN1N0VGVlLTdaR1hxZUxaanRJeXeAAwCIAwGQAwCYAxegAwGqA00SEzEzNjIyODc4OTk1Nzk5ODQ2NTEaEzg4MDI3MjMxNjI5NDMwNTE4NTMiCTMwNzk5OTM4MCoNT0FUSDEwMTcwMDAwMDoHMzY1MTU1N8AD4KgByAMA2AO21bcB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjg5LjIzOC4xNDIuMjE1qAQAsgQQCAEQBBiQAyDhASgCMAA4A7gEAMAEAMgEANoEAggB4AQA8ASU5e6SAYgFAZgFAKAF7qfdod-3k6kfwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFvY0H-gUECAAQAJAGAZgGALgGAMEGAAAAAAAA8D_QBuS_AdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgTyBgIIAIAHAYgHAKAHQKoHBzE3OTk2NzK6Bw8IABAAGAAgADAAOKIKQADIB7KQBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHw9ZkiggCEAA.&s=73966e40153798b0262f47af21c5c9686d992884
Request Chain 218
  • https://gcdn.2mdn.net/videoplayback/id/f987a42d353e57ff/itag/37/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3765685876/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signature/8FE4FB8AF9FE805918741ACCD018F19EA9EBAEF6.5127362800F278CD9462D7497EDA26040F542461/key/ck2/file/file.mp4 HTTP 302
  • https://r3---sn-aigzrne7.c.2mdn.net/videoplayback/id/f987a42d353e57ff/itag/37/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3765685876/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,rmhost,source/signature/49222DE1BB06B1BB4C0B7021DA2D77F3B8B9D63D.1E2B42F531F0F0AF2FFBD886D002A6CDCBEAB78A/key/cms1/cms_redirect/yes/hcs/ir/mh/BZ/mip/2001:ac8:21:23:2db::1/mm/42/mn/sn-aigzrne7/ms/onc/mt/1638262842/mv/m/mvi/3/pl/48/rmhost/r1---sn-aigzrne7.c.2mdn.net/file/file.mp4
Request Chain 240
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=YaXqDQAIZSEhowBR HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=YaXqDQAIZSEhowBR&_origin=0&gdpr=0&gdpr_consent=&_test=YaXqDQAIZSEhowBR HTTP 302
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YaXqDQAIZSEhowBR&_origin=0&gdpr=0&gdpr_consent=&_test=YaXqDQAIZSEhowBR&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
Request Chain 241
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e&verify=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVAxNWQ3MWIwYS01MWJkLTExZWMtYWU1ZS0wMjBjNDQyOTY3NWU%3D HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEMZe-LQWVs-WGNPA3xvNIqk&google_cver=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMZe-LQWVs-WGNPA3xvNIqk&google_cver=1&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
Request Chain 242
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=baec76b8-1fae-471f-8226-e5fbe7c59c0c&_origin=1&gdpr=1&gdpr_consent=
Request Chain 248
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0&C=1
Request Chain 249
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgdpr%3D0%26google_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=casale_media2_dsp_secure&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0
Request Chain 250
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAhERPXqi6p0DleEtiKnfnU&google_cver=1
Request Chain 251
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTEzMDcyMzY5MTc2NjE0MjIzNw%3D%3D
Request Chain 254
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
Request Chain 255
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
Request Chain 256
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
Request Chain 258
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
Request Chain 259
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
Request Chain 260
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
Request Chain 273
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=f0a061a5-ea0d-4f00-a403-cf47764996bb
Request Chain 274
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
Request Chain 275
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=834006166056631821
Request Chain 278
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
Request Chain 279
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=19a961a5-ea0d-4b00-9fe4-f5ca6e1eeea1
Request Chain 280
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
Request Chain 281
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3779540836316986857
Request Chain 284
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
Request Chain 302
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1361929279369711967
Request Chain 303
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5GH8uJZ4RWWxPRsmC-P3uQ%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 304
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=f0a061a5-ea0d-4f00-a403-cf47764996bb
Request Chain 305
  • https://pixel.onaudience.com/?partner=214&mapped=E461FCB8-9678-4565-B13D-1B260BE3F7B9 HTTP 302
  • https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25 HTTP 302
  • https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1 HTTP 302
  • https://pixel.onaudience.com/?partner=161&icm&cver&mapped=529534b7feba3bab8cb34c8a46e6703d
Request Chain 306
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RTQ2MUZDQjgtOTY3OC00NTY1LUIxM0QtMUIyNjBCRTNGN0I5&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKuL86I8gGE-ASYitiQTKYc&google_cver=1
Request Chain 309
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Request Chain 310
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=834006166056631821
Request Chain 311
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 312
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
Request Chain 313
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YaXqDmdMgARsAxdRjdxjjQAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
Request Chain 314
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
Request Chain 317
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=Tbc5Ux7naF9W4z5XH7V1Vhm_aF9Wtm1WTb8RVkwy
Request Chain 319
  • https://beacon.lynx.cognitivlabs.com/ix.gif HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
Request Chain 322
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
Request Chain 323
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
Request Chain 324
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YaXqDmdMgARsAxdRjdxjjQAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
Request Chain 325
  • https://p.rfihub.com/cm?in=1&pub=2079&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5142336718970418140
Request Chain 326
  • https://ums.acuityplatform.com/tum?umid=8 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=626567909448
Request Chain 327
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-99c6a6b4-33e7-474a-8ca7-31ce588ad3f8
Request Chain 375
  • https://sync.serverbid.com/ss/2000891.html HTTP 302
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Request Chain 380
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 387
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=uotbja5c1MRZ7N5
Request Chain 388
  • https://x.bidswitch.net/sync?ssp=openx HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx HTTP 302
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dopenx HTTP 307
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dopenx HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=53796c53-a8e5-4a26-ac1e-9424f8b6f92c&ssp=openx HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Request Chain 389
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=1130723691766142237
Request Chain 390
  • https://match.prod.bidr.io/cookie-sync/ox HTTP 303
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCaldFN0RTOVFBQUN0M3hORVJxQQ&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
Request Chain 392
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=16&3pid=no-consent&gdpr=1&gdpr_consent=
Request Chain 393
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=87&3pid=b57f3c75-9f18-41d4-85b3-bee7f9b0b921
Request Chain 394
  • https://sync.mathtag.com/sync/img?mt_exid=17&mt_exuid=b6671e3b1468cdefc62a5f06&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D3%263pid%3D%5BUUID%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=3&3pid=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Request Chain 395
  • https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3234479222 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/baec76b8-1fae-471f-8226-e5fbe7c59c0c HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003 HTTP 302
  • https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Request Chain 397
  • https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=YjY2NzFlM2IxNDY4Y2RlZmM2MmE1ZjA2&gdpr=0
Request Chain 398
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
  • https://ce.lijit.com/merge?pid=85&3pid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
Request Chain 399
  • https://bcp.crwdcntrl.net/5/c=5436/tp=SVRN/tpid=b6671e3b1468cdefc62a5f06/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=b6671e3b1468cdefc62a5f06/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=5001&3pid=771919e7d17ffd103da5ab588dafe287&gdpr=0&gdpr_consent=
Request Chain 400
  • https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=Uy24nQB96ZFIeb-ZAS_0mAcl6ZFILOyYUyWEd0tv
Request Chain 403
  • https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=49&3pid=h2HhD6496tI5&ev=1&pid=558511&gdpr_consent=&gdpr=0
Request Chain 404
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=12&3pid=1130723691766142237&gdpr=0&gdpr_consent=
Request Chain 406
  • https://aorta.clickagy.com/pixel.gif?ch=185&cm=b6671e3b1468cdefc62a5f06&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=84&3pid=c:953a830b82e426f0303e7bec2ebff883
Request Chain 407
  • https://aax-eu.amazon-adsystem.com/s/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent= HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Request Chain 408
  • https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=YjY2NzFlM2IxNDY4Y2RlZmM2MmE1ZjA2&gdpr=0 HTTP 302
  • https://ap.lijit.com/dsp/google/reporting?gdpr=0
Request Chain 409
  • https://p.rfihub.com/cm?in=1&pub=1827&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=10&3pid=5142336718970418140
Request Chain 410
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1 HTTP 302
  • https://ce.lijit.com/merge?pid=86&3pid=FtmPq0W5wKG8DnOE0zfx&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
Request Chain 411
  • https://ums.acuityplatform.com/tum?umid=27&uid=b6671e3b1468cdefc62a5f06&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=66&3pid=626567909448
Request Chain 412
  • https://um.simpli.fi/lj_match?r=1638263311530&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=2&3pid=89826316FD594721B7F44E0BE3B1CA45
Request Chain 413
  • https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent= HTTP 302
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=fmx&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=fmx&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=b705a7be-a449-4530-aad1-68df0e501ffb&user_group=1&ssp=fmx&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://ce.lijit.com/merge?pid=26&3pid=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Request Chain 414
  • https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent= HTTP 302
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q6915497121270947050&ref=%2Feucm%2Fp%2Fsv HTTP 302
  • https://px.owneriq.net/noop?ct=image%2Fgif
Request Chain 421
  • https://d.turn.com/r/dd/id/L21rdC8xMjcvY2lkLzI4NTUyOTczL3QvMg/url/https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1%263pid%3D%24!%7BTURN_UUID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=1&3pid=3239295199777413054&gdpr=0&gdpr_consent=
Request Chain 427
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID HTTP 302
  • https://ads.servenobid.com/sync?pid=312&uid=1130723691766142237
Request Chain 428
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D HTTP 302
  • https://ads.servenobid.com/sync?pid=310&uid=b6671e3b1468cdefc62a5f06
Request Chain 429
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4724393866 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/baec76b8-1fae-471f-8226-e5fbe7c59c0c HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003 HTTP 302
  • https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Request Chain 431
  • https://p.rfihub.com/cm?pub=44007&in=1 HTTP 302
  • https://ads.servenobid.com/sync?pid=324&uid=5142336718970418140
Request Chain 433
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D HTTP 302
  • https://ads.servenobid.com/sync?pid=327&uid=430cfaba-49db-418d-9caf-960d8e2e9748&gdpr=0&gdpr_consent=&us_privacy=1YN-
Request Chain 437
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEH02qP1h8PWo9l2tBwvn3rE&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Request Chain 438
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1MTk0NDAxODE5MzgyNTAyMDc%3D
Request Chain 440
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/11519440181938250207?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-JScxTgxE2oSYnm5axIk1o66HwsnbrbvPtyy3vrKNvA--~A&dongle=0883
Request Chain 443
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=11519440181938250207 HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=11519440181938250207&dcc=t
Request Chain 444
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Request Chain 445
  • https://ad.turn.com/r/cs?pid=49&gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=4771&xuid=3022260984283505521&dongle=d407
Request Chain 448
  • https://ad.turn.com/r/cs?pid=21&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3094318578321433457
Request Chain 450
  • https://beacon.lynx.cognitivlabs.com/ix.gif HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
Request Chain 451
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1&gdpr=1 HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1638349711&gdpr=1
Request Chain 452
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
Request Chain 455
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
Request Chain 456
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_a6452d23-5ce2-479e-b91d-1f0b66f80513&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=b705a7be-a449-4530-aad1-68df0e501ffb&user_group=1&ssp=gumgum2&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Request Chain 457
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=sta&i=0-82f1fa72-68fb-45b9-6048-dedb9eb08564$ip$89.238.142.215
Request Chain 458
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_a6452d23-5ce2-479e-b91d-1f0b66f80513&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://rtb.gumgum.com/usersync?b=zem&i=&gdpr=0
Request Chain 459
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003&rndcb=1800554444 HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=98d76fa9-5328-4570-b396-d13f5c3fbb99&ssp=adconductor&expires=30&user_group=5&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/fab7c4a6-2a45-4e9e-8d31-621eb4f79233?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Request Chain 460
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://rtb.gumgum.com/usersync?b=pln&i=y7uTHXrBROn7&ev=1&pid=558355
Request Chain 461
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82%29 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_593e0f56-57f2-437d-8d59-8add6b779ffc&obuid=ENC(EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82) HTTP 302
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
  • https://sync.hgrtb.com/outbrain?cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dmediaforce_custom%26obUid%3DEIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82%26uid%3D%7BUSER_ID%7D HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=mediaforce_custom&obUid=EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82&uid=a83faa2b-448f-4307-9aa0-69172bcd385c
Request Chain 462
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
Request Chain 463
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
Request Chain 464
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=vnt&i=174af63b-51bd-11ec-b606-850e07abf4e3
Request Chain 467
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
Request Chain 476
  • https://ad.turn.com/r/cs?pid=21&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3239295199777413054
Request Chain 480
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=1&gdpr_consent=
Request Chain 483
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
Request Chain 484
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 485
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Request Chain 486
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
Request Chain 490
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5ukAAKqmDKkAAAAA
Request Chain 491
  • https://p.rfihub.com/cm?pub=42796&in=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Request Chain 492
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
Request Chain 493
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
Request Chain 494
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_593e0f56-57f2-437d-8d59-8add6b779ffc&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=gumgum2&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=gumgum2&gdpr=0&user_id=jE7ZLt8eiCKXGt4q3kyVK9hGiCKXT40rjEbsaRvQ HTTP 302
  • https://rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Request Chain 495
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=sta&i=0-5bb60842-c657-42ec-7e6c-cc082bd2a647$ip$89.238.142.215
Request Chain 496
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_593e0f56-57f2-437d-8d59-8add6b779ffc&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://stags.bluekai.com/site/23178?id=lwCPDZZPoXDoqqAGvDcZ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT23DXINIEIWS2KBXVQRDPOFYUCR3WIRRVUJTVONPXA4TJOZQWG6J5GEWS2LI&gdpr=0&us_privacy=1--- HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT23DXINIEIWS2KBXVQRDPOFYUCR3WIRRVUJTVONPXA4TJOZQWG6J5GEWS2LI HTTP 302
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=lwCPDZZPoXDoqqAGvDcZ&us_privacy=1---
Request Chain 497
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003&rndcb=6674860021 HTTP 302
  • https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=283&user_id=8745dc56-754a-4b93-98ae-0fa50d57708c&expires=1&user_group=5&ssp=adconductor&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/fab7c4a6-2a45-4e9e-8d31-621eb4f79233?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Request Chain 498
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://rtb.gumgum.com/usersync?b=pln&i=dHeAzadHdrMs&ev=1&pid=558355
Request Chain 499
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28oolCbMdrA2OJf12hbkCH-PIIqkIZcGqhQ-2YYWwi4PTKz-I4ZAn68fWXomgoyGOr%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28oolCbMdrA2OJf12hbkCH-PIIqkIZcGqhQ-2YYWwi4PTKz-I4ZAn68fWXomgoyGOr%29 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_593e0f56-57f2-437d-8d59-8add6b779ffc&obuid=ENC(oolCbMdrA2OJf12hbkCH-PIIqkIZcGqhQ-2YYWwi4PTKz-I4ZAn68fWXomgoyGOr) HTTP 302
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
  • https://tempsyncurl.com/
Request Chain 500
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
Request Chain 501
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
Request Chain 502
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=vnt&i=175136f7-51bd-11ec-91c0-1b27083715d9
Request Chain 505
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
Request Chain 509
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=MjcxNjc1MTczNDc5NDc0ODk0OQ==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEAkZyRD-gwLg6NlHcFX7jio&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 510
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=1130723691766142237&gdpr=0&gdpr_consent=
Request Chain 511
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3D72348060-38ad-4586-8e4f-f1e2a8e789b3%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=2716751734794748949&gdpr=0&gdpr_consent=
Request Chain 512
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
Request Chain 514
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
Request Chain 515
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 516
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Request Chain 517
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
Request Chain 521
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5sAAAFxkJAUAAAAA
Request Chain 522
  • https://p.rfihub.com/cm?pub=42796&in=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Request Chain 523
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
Request Chain 524
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKTzqRCkaqXUwwr7_twY-n4&google_cver=1
Request Chain 527
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=f0a061a5-ea0d-4f00-a403-cf47764996bb&expires=28
Request Chain 528
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWLVO99D-W-87ZX&sigv=1&esig=2~65b4a1185240ae143659cffbf5d1b4ad1aeb654f
Request Chain 529
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dMVk85OUQtVy04N1pY
Request Chain 533
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Request Chain 537
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=1130723691766142237
Request Chain 538
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YaXqDmdMgARsAxdRjdxjjQAA%261821
Request Chain 539
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID HTTP 307
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=b6671e3b1468cdefc62a5f06
Request Chain 541
  • https://pixel.advertising.com/ups/56621/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
Request Chain 542
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
Request Chain 543
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D HTTP 302
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c HTTP 303
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c&_li_chk=true&previous_uuid=43874f65488445ffbf4724695a16eea2 HTTP 303
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c

566 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
threatpost.com/ikea-email-reply-chain-attack/176625/ 		92 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
57557fd3d6204ee05b9cf2ec6b7569991d33655a3cf51ce6bb1c356924ae01ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9

Response headers

Server
nginx
Date
Tue, 30 Nov 2021 09:08:23 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Link
<https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/176625>; rel="alternate"; type="application/json" <https://threatpost.com/?p=176625>; rel=shortlink
X-Frame-Options
SAMEORIGIN
X-Debug-Auth
off
X-Request-Host
threatpost.com
x-cache-hit
HIT
Content-Encoding
gzip
museosans-900italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8edaef698e025c37ba9e8d632a895d7252c62251df3f095d5cff17b6f3304854

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:23 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
"61a48378-3ca8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
15528
museosans-900-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4823c011e4b4cb4b7f35ced3ab09d57215ee243676d9bfcc24d10ec77d3db398

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:23 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:33 GMT
Server
nginx
ETag
"61a48379-5124"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20772
museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:23 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
"61a48378-3dcc"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
15820
museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:23 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
"61a48378-51a4"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20900
museosans-500italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:23 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
"61a48378-5c74"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23668
museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:23 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:33 GMT
Server
nginx
ETag
"61a48379-5194"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20884
museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:24 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:33 GMT
Server
nginx
ETag
"61a48379-5bac"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23468
museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:24 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
"61a48378-51b8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20920
museosans-100italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
038fc4d49a9191d416d49841f371b6e0b06bb40f719124099d40fe8f393b9e2c

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:24 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
"61a48378-5b34"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23348
museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:24 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:33 GMT
Server
nginx
ETag
"61a48379-50c8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20680
op.js
tagan.adlightning.com/math-aids-threatpost/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
42ed7aa3c5ae0a7364bc29f147c026511b05c3291ba385ef342982ef0ff3dc75

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
AbAsbKFV.mxj2R4ML75axe_ynf4vkYd_
content-encoding
gzip
etag
"2f472734332ad67bbdca72de1f43c180"
age
257
x-cache
Hit from cloudfront
content-length
18417
x-amz-meta-git_commit
7b120a5
last-modified
Fri, 26 Nov 2021 19:04:44 GMT
server
AmazonS3
date
Tue, 30 Nov 2021 09:07:40 GMT
content-type
application/javascript
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
4QupADC2Ddh021K3iYz22X60LYOXLcMPCzS0uBkaklSXrjNTAKqxfQ==
gpt.js
www.googletagservices.com/tag/js/ 		77 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
71c6ea85dba250b22bc1baaa084572f76dcbb99cb2779e5a603aa867717889a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1059 / 188 of 1000 / last-modified: 1637708722"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26863
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 30 Nov 2021 09:08:24 GMT
ros-layout.js
qd.admetricspro.com/js/threatpost/ 		26 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4fddec1cb13ee6848cce386a733d405fff2be9ab4d904f55a1d15c7cc84f410d

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:23 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
190
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Wed, 03 Nov 2021 12:58:13 GMT
server
cloudflare
etag
W/"67a6-5cfe1f68177b1-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=642BhI81NkgKu%2BTUQ9CfcBT4YIQISE5mwuL1OlF2O3dvrmFgarRCNVzwsneKUNBRXYl7trZurollhMxrYFquvt%2FsT21qruS0ZHYlHvyCjtTAjJEwlU%2BNNbJyqogdmz8gUdc4i5TWi9cSayS8nW9%2BKyN1"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6b62ee510df13743-MXP
expires
Tue, 30 Nov 2021 09:15:12 GMT
cmp.js
qd.admetricspro.com/js/threatpost/ 		310 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Tue, 01 Jun 2021 14:47:10 GMT
server
cloudflare
etag
W/"4d957-5c3b56abf6028-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rG1mPfjQZIGtMPSCbJVOYNLLKbkPeoyQnXwEVd78r%2B1kz9x8GQqhBh2oeyLxBSgbppI9hIwMjzcjBIo3j%2F%2F5mLaE6gmkfWwL89ukEJQVgHzEPYxXbNbw%2FNKoyO17NUBUlDSIjj3%2Fk0WN1d7YZVACvQFF"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6b62ee55db313743-MXP
expires
Tue, 30 Nov 2021 09:13:58 GMT
uspcmp.js
qd.admetricspro.com/js/threatpost/ 		148 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Sat, 08 Aug 2020 22:40:07 GMT
server
cloudflare
etag
W/"24e50-5ac65673cef1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zcMBMjntkDXNX7RT6utOaO0H%2FHg6l%2BAQ%2FpA6%2BGVPewtTngMSdRVyiOCmbud%2BJURkevHZ4d576hho17ytuJ%2FsZi0WCRe70v8tQ70e1ufuQGGa74LmMYtMVVWMnOo9P8shG0lo4lR1ukTo1VENyc5yte3F"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6b62ee55db343743-MXP
expires
Tue, 30 Nov 2021 09:14:43 GMT
targeting.js
qd.admetricspro.com/js/threatpost/ 		393 B
554 B 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03cc687f0c8a2d1694e509b91fcd6c62c0fbdbdbdb850b8007b8052f649c7f77

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 21:50:12 GMT
server
cloudflare
etag
W/"189-5c8c2c96f96c7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2B0v%2F2lPI2tbBX3TvohU7umMjJbXKUrw7QsrMZQGIuOhnDQmuUuA%2F%2BTT1jQCZpinlM7WdrglI6q50BnNuq6aTbbliFOAJxyXKw9qBpsKjlrajoksjP8dNKIr8Fbar7A9iq93qyzH0BngxMe7rrbGMUpt"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6b62ee55db373743-MXP
expires
Tue, 30 Nov 2021 09:15:13 GMT
prebid.js
qd.admetricspro.com/js/threatpost/ 		430 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Thu, 14 Oct 2021 15:35:01 GMT
server
cloudflare
etag
W/"6b738-5ce51d26ef74c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8FZlRd26rFvFU0iDlISbD9MOrPPXNtCSC88ohqrkEqTJySq%2FFefXOesG3D5S8KSVdoYhntBbqmJTCzq6pnFftzDIK5SFmfFNMVzZILSFV2Acdw8kkTtCdfgxgfVZpwWcH6R8zMgXGyve8wA2yFWxJfJR"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6b62ee55db383743-MXP
expires
Tue, 30 Nov 2021 09:05:53 GMT
engine.js
qd.admetricspro.com/js/threatpost/ 		35 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/engine.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a355508d811ac666d1b61e566f7f1daf5d39b8915c036b271f14a4cfb9247ac3

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:23 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
190
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Fri, 15 Oct 2021 02:14:43 GMT
server
cloudflare
etag
W/"8b7c-5ce5ac22db48b-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QibGvtvC42E6mrRzbG%2BOgUz%2FrEd2NLVflVpT1c06RZmJeFnGhg7IToGKNA50BGM0cKUQO6kBpVtZfUTJ0pOuhzxrcDNEdjgHQb%2Be%2By6bm%2BEZRVOJPV%2F%2B9xDa%2FViduldrRPhTlvhIYBeLkqHaqWBApwVh"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6b62ee510df33743-MXP
expires
Tue, 30 Nov 2021 09:06:52 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		292 KB
42 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
651e04b0e5647f9e2913196fa892689f13772efe4636cc1bbdad48868f67e1ce
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2-C1
x-cache
Miss from cloudfront
content-length
42435
x-cache-hit
HIT
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
8Iml6V8nmI4F-YqAVfzDaUZz4HjWE-XmXYxbwLVATtKQqFvQsdiCpA==
expires
Tue, 30 Nov 2021 19:10:55 GMT
jquery-1.12.4-wp.js
threatpost.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/ 		95 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
public
Date
Tue, 30 Nov 2021 09:08:24 GMT
Content-Encoding
gzip
Last-Modified
Mon, 29 Nov 2021 07:38:33 GMT
Server
nginx
ETag
W/"61a48379-17a56"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Tue, 07 Dec 2021 09:08:24 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=a6d9acd7
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
b813e47b551a74f55e504ad2e4a7fdb97ee55a9497486ffa61f4dfc34e6fd338
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2-C1
x-cache
Miss from cloudfront
content-length
6410
x-cache-hit
HIT
last-modified
Mon, 29 Nov 2021 07:38:33 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
3FcZCwe6L03-yfX-R1B-uITAn721jPRo57Kk9mvhaZeqpXW4yXNqUQ==
expires
Tue, 30 Nov 2021 19:11:11 GMT
ikea-scaled-e1638219440979.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2021/11/29155618/ 		43 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/11/29155618/ikea-scaled-e1638219440979.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f821648812445031d5fa278d7ce7469bd8760ea5c1c4f023b9787536e49068f0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 21:22:19 GMT
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 20:57:21 GMT
server
AmazonS3
age
42366
etag
"649f53f79e146725f14b5fdd8ea32ccb"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA2-C2
accept-ranges
bytes
content-length
44520
x-amz-cf-id
zMRm-GgvZs0zz2n5xKnxHeWVLiMn1RS3dDHCHnfeJ2JpM57v_8WHyA==
expires
Tue, 29 Nov 2022 20:57:20 GMT
api.js
www.google.com/recaptcha/ 		852 B
968 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?hl=en&render=explicit
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
71cec2485cdafd67b2aeffca3c58ccda458fcf5bf96bd01a2776348016f782c7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
555
x-xss-protection
1; mode=block
expires
Tue, 30 Nov 2021 09:08:24 GMT
scripts.js
kasperskycontenthub.com/threatpost-global/wp-content/plugins/kaspersky-embeds/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/threatpost-global/wp-content/plugins/kaspersky-embeds/js/scripts.js?ver=1.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
public
Date
Tue, 30 Nov 2021 09:08:24 GMT
Content-Encoding
gzip
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
W/"61a48378-828"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Tue, 07 Dec 2021 09:08:24 GMT
api.js
www.google.com/recaptcha/ 		852 B
620 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=explicit&ver=202124050927
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
71cec2485cdafd67b2aeffca3c58ccda458fcf5bf96bd01a2776348016f782c7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
555
x-xss-protection
1; mode=block
expires
Tue, 30 Nov 2021 09:08:24 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=a6d9acd7
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2-C1
x-cache
Miss from cloudfront
content-length
926
x-cache-hit
HIT
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
pcIHaPILt6rO2j4F_Io1YObXZLDytjhpVthkL-UjHz-UEAqyVl3LJg==
expires
Tue, 30 Nov 2021 19:11:01 GMT
gravityforms.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
public
Date
Tue, 30 Nov 2021 09:08:24 GMT
Content-Encoding
gzip
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
W/"61a48378-88c2"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Tue, 07 Dec 2021 09:08:24 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=a6d9acd7
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2-C1
x-cache
Miss from cloudfront
content-length
2685
x-cache-hit
HIT
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
mnxqFGXKnxybqf5LFsSAPepP1BibLzY7vTMDSMWHaRHPhu3-it3oIg==
expires
Tue, 30 Nov 2021 19:10:53 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=a6d9acd7
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2-C1
x-cache
Miss from cloudfront
content-length
1747
x-cache-hit
HIT
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
87whL46B4jqNBDJN2UxGVesAvueK_2agvDYkB0WRy0ji5CHkV5CJSw==
expires
Tue, 30 Nov 2021 19:10:55 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		161 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-gravity-forms-dynamic-recaptcha/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=a6d9acd7
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
164f113713f0f15f300354fb36e2f2529e5d2f74c0b88ed714e745a277e4be02
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2-C1
x-cache
Miss from cloudfront
content-length
51515
x-cache-hit
HIT
last-modified
Mon, 29 Nov 2021 07:38:33 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
3PxybdB_irElHwuiPtvxvmjc7OM_6HNgcSAq_KlOWmYQ6v9HMqE_RQ==
expires
Tue, 30 Nov 2021 19:10:53 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		134 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.198.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-198-4.fra2.r.cloudfront.net
Software
Server /
Resource Hash
de80309d98405d566c6fb1912811b24c8ad3a8380f6819d26a6c1eac5cd99185

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
KuXuY5mbG6yln5YsEdf9JaPJtFF6aIqm
content-encoding
gzip
etag
1e39d25f07f5619925357b752ab10d04
age
498
x-cache
Hit from cloudfront
server
Server
x-amz-rid
0J5GV0A61BJXW5CE831R
date
Tue, 30 Nov 2021 09:07:40 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 e86025dac63232624d2273c5fd256ce4.cloudfront.net (CloudFront)
cache-control
public, max-age=900
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
lhDkwKI3QVh9V8u0S7tRB7hQ3_qip6njO4k62lbz6tPZfByGFL3PBA==
connatix.player.dc.js
cds.connatix.com/p/140482/ Frame 42CC
Redirect Chain
  • https://cd.connatix.com/connatix.player.js
  • https://cds.connatix.com/p/140482/connatix.player.dc.js
1 MB
232 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/140482/connatix.player.dc.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5bd347e9dae9ec34879d4efd95c533f3772e972964d47edceb1297c03e086805

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
br
last-modified
Fri, 26 Nov 2021 12:04:31 GMT
age
333829
etag
"53d01b3d1aa4270da3b3b1d85de185c5"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
236844

Redirect headers

location
https://cds.connatix.com/p/140482/connatix.player.dc.js
date
Tue, 30 Nov 2021 09:08:24 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
server
Kestrel
accept-ranges
bytes
content-length
0
/
kasperskycontenthub.com/ 		0
398 B 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=548348071&back=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:24 GMT
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
Connection
close
Content-Type
application/javascript
x-cache-hit
HIT
Transfer-Encoding
chunked
X-Debug-Auth
off
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Request-Host
kasperskycontenthub.com
X-XSS-Protection
1; mode=block
gtm.js
www.googletagmanager.com/ 		177 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3f503cb02a2a8c63ce88a8ff414873033d7519b9166f8dbc488fed45c624bd54
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
60042
x-xss-protection
0
expires
Tue, 30 Nov 2021 09:08:24 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 		13 KB
13 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:24 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:33 GMT
Server
nginx
ETag
"61a48379-3496"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
13462
icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 		13 KB
13 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/ikea-email-reply-chain-attack/176625/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:24 GMT
Last-Modified
Mon, 29 Nov 2021 07:38:32 GMT
Server
nginx
ETag
"61a48378-3496"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
13462
logo.png
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-4a32"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
18994
x-amz-cf-id
68wTFa4hg4Q2mXsbyAqBKEdS863LKGMCQlv2m9Rgf6jm-b0pvr9Ojg==
expires
Tue, 07 Dec 2021 09:08:24 GMT
mail-plane-light.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		828 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-33c"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
828
x-amz-cf-id
eHDon3-mLXAuJNbotkmI7XPCG1Tesy8mSE_GP7RuX3GBUucpD26H4w==
twitter-blue.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		868 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-364"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
868
x-amz-cf-id
6SF7mcwds6T9USagnIHawa-WnBreVF-tbVvehnevluaRaTbtj6UL5w==
museosans-700-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-51a4"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20900
x-amz-cf-id
JTR88Es2rQ-gktPMDjISjeP6hI--zFq0XtmCNHAc0D3NRQpbjnjWKA==
museosans-100-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-50c8"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20680
x-amz-cf-id
yvcxG0vCbk_-4s1WqfyTskoReBL8dA9QXtM2Q0h9CwLxvJTcZtAZOQ==
museosans-300-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-51b8"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20920
x-amz-cf-id
9HBS82haxDB-eeQj-WdPFO5A0w4NraDtO1o7v8M_V-v5SKDB_aLO8g==
museosans-500-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-5194"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20884
x-amz-cf-id
5dm1eVCfc1SG9KJlEaq_5ADxvwRbrSgBa-IxFRUJjyes9oaJN_76pQ==
museosans-500italic-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:33 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48379-5c74"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
23668
x-amz-cf-id
reXCtXfbE2zdRzebtCVTLDv_gnSZYKDO7slDXAg8bShc-zrsJI5yQg==
museosans-700italic-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-3dcc"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
15820
x-amz-cf-id
M2qaZStkMertv_Bx15McUXSOlN5I-uSr1LtPHJ2kLYadz0OPyBmJPA==
museosans-300italic-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-5bac"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
23468
x-amz-cf-id
YQC29P5vsal47vvX_E8d6mIyPzce55aF9eAH6Q6721hKe5MUC-jT3w==
player.css
cds.connatix.com/p/140482/ 		53 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/140482/player.css
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7f7a2dc8aba3c3e447f512c5db932f05241c1441b2188d87abf759b1a85295c2

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:24 GMT
content-encoding
br
last-modified
Fri, 26 Nov 2021 12:04:32 GMT
age
333830
etag
"eb561df918de3fc2dbd966c4d0470447"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
8321
mail-plane-large-dark.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		812 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-32c"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
812
x-amz-cf-id
DzH4NWPuKY-OgpFPe-1uhpS1fsFZacMvsZlYpN8KN7MDAVYtBJAWGw==
logo-white.png
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
public
date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:32 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48378-260a"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
9738
x-amz-cf-id
71Y_uq6S_2wJY520dan-g-Cf34mDANolZbOYoT3P93-2K2_viZonDA==
expires
Tue, 07 Dec 2021 09:08:25 GMT
Lisa-Vaas-Headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/05/05095532/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05095532/Lisa-Vaas-Headshot.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d5a65e5129df0b4c89e73f205c6cb89cba0cd1d8e21a1512ca76b769634052d

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 26 Sep 2021 09:50:16 GMT
via
1.1 018ffb575888f1c9ec960e3e977c042f.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Tue, 25 May 2021 13:37:34 GMT
server
AmazonS3
age
5613489
etag
"78f8fd88850c65941db84cb8bf0d741d"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA2-C2
accept-ranges
bytes
content-length
18649
x-amz-cf-id
GE1Me1L57pv1l8mMIirg7V1drn0-iKUgdzv7NWzlH7oZSCG-4kH2yA==
expires
Wed, 25 May 2022 13:37:32 GMT
infosec_insiders_in_article_promo.png
media.threatpost.com/wp-content/uploads/sites/103/2021/07/10165815/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/10165815/infosec_insiders_in_article_promo.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bbe4e4e4e847a32bd717d963f0ac04b619a7a9cdd631a7454d9dfec16fbae73f

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 02:51:30 GMT
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Tue, 10 Aug 2021 20:58:17 GMT
server
AmazonS3
age
9613015
etag
"101ba02c43488b8b07cf42f9aa850f6a"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA2-C2
accept-ranges
bytes
content-length
20484
x-amz-cf-id
itTomJsnk4Z-t-Ea3N5bqlbM7-GDlL1MPAVU4AtKp0lshB-3DClgPw==
expires
Wed, 10 Aug 2022 20:58:15 GMT
phishing-email-e1638214934826.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2021/11/29144159/ 		41 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/11/29144159/phishing-email-e1638214934826.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f9389b0641544c2777142c53a0f94e9e4053e1dac3c062f62cf81ba327445a63

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 21:22:36 GMT
via
1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 19:42:15 GMT
server
AmazonS3
age
42349
etag
"fea737e0bfa989188f5101dc918f5e72"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, FRA2-C2
accept-ranges
bytes
content-length
42490
x-amz-cf-id
tPPjKHRgXlUFMTRV11wqEUBI-xp_8cIa9huxVYK1JHVWC_aNNtPcBw==
expires
Tue, 29 Nov 2022 19:42:14 GMT
Malicious-Microsoft-Excel-document--e1637602000585.png
media.threatpost.com/wp-content/uploads/sites/103/2021/11/22122626/ 		202 KB
203 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/11/22122626/Malicious-Microsoft-Excel-document--e1637602000585.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a19736654ddf761ddee7392457d6fc5f2ce5c2e94c9e5d076d275d5f251a0a82

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 19:26:52 GMT
via
1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Mon, 22 Nov 2021 17:26:41 GMT
server
AmazonS3
age
654093
etag
"e38399b359af079494f68b864baffe29"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA2-C2
accept-ranges
bytes
content-length
207003
x-amz-cf-id
LsWybgd6hz9VV7mUlnzJ5eIBvtngMHFVgiRKeWdjpFtymwbAStoj_Q==
expires
Tue, 22 Nov 2022 17:26:40 GMT
Picture1-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/11/22160337/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/11/22160337/Picture1-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8c895754b308383c68611631c019bd62013416b37bcdf3e2d3f5ddf1c031151d

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:09:09 GMT
via
1.1 3aad72975c9da06e6d0903ad874f0b54.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Mon, 22 Nov 2021 21:03:40 GMT
server
AmazonS3
age
489556
etag
"91a6e5d2b2145e885b56e73d694d73e3"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA2-C2
accept-ranges
bytes
content-length
2523
x-amz-cf-id
U-4jysuZLIqP4XtQrOoff0ga3w0esTJ4S0MwGR2qWI3qb957kxTeaQ==
expires
Tue, 22 Nov 2022 21:03:39 GMT
grinch-1898511_1280-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/11/22150527/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/11/22150527/grinch-1898511_1280-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
02bb51e187485e1c631882cbe782a7786ea7f8ce585e7ae4b99bbb943945c0a0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:16:16 GMT
via
1.1 4a502b22092e94faddf9a5b056e273ae.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Mon, 22 Nov 2021 20:05:33 GMT
server
AmazonS3
age
651129
etag
"f92ac91d08a902ec1a658be5dbf3966f"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA2-C2
accept-ranges
bytes
content-length
2657
x-amz-cf-id
b4wXeCnlsktjv-PPsJ31CzFKWIayrgk1y51uYkSvcbTs2OMaA52F_w==
expires
Tue, 22 Nov 2022 20:05:32 GMT
fish-tropical-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/11/18134711/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/11/18134711/fish-tropical-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
745f534b16a94e23c3c4eed4fb75adc7244e9a472556c1b3cc0490a1518219ad

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 18:50:03 GMT
via
1.1 a267c4458d5587daaaf85f1d134a02d4.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Thu, 18 Nov 2021 18:47:17 GMT
server
AmazonS3
age
1001902
etag
"ca8720b4682cb9b6c82e64878aab0d75"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA2-C2
accept-ranges
bytes
content-length
2571
x-amz-cf-id
xlLMyC7dJiuDnOeXsQ1DjNCTb4R892WDY-XZfTeUFEmoAWAvlWcL6A==
expires
Fri, 18 Nov 2022 18:47:16 GMT
Emu-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/11/16164451/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/11/16164451/Emu-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0a3699c8bdd78b075514392d4384b3e94c5c9e07fc1ff4e1501af45180463c47

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 21:47:00 GMT
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Tue, 16 Nov 2021 21:45:00 GMT
server
AmazonS3
age
1164085
etag
"395e7c7c30d4fdc8d4e60466603ebef7"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA2-C2
accept-ranges
bytes
content-length
1738
x-amz-cf-id
Nyo8VW12a9UwiW-tZinIPZ-B34OCa_OeP2KtkeTaoNes74BkQf7Rvw==
expires
Wed, 16 Nov 2022 21:44:58 GMT
checklist2-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/10/19100940/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/10/19100940/checklist2-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7fd9983a3429d6ead1f66bf933770f9b790818b189e39ff0f2a0d3f590bbf67b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 20:26:33 GMT
via
1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront), 1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront)
last-modified
Tue, 19 Oct 2021 14:09:44 GMT
server
AmazonS3
age
1514512
etag
"14bf40c9dffffaec5cd1337f170dac93"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA2-C2
accept-ranges
bytes
content-length
2112
x-amz-cf-id
jonokhtglawJIZFhm1krqkjZ_S3cbbFmj_D4TMjxWmMHMvPr2rRsUA==
expires
Wed, 19 Oct 2022 14:09:43 GMT
pls
capi.connatix.com/core/ Frame 42CC 		14 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/pls?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
eb0f49efa8636d3c10bce91d1babcb192373903c2cbb08f3ac52c1abdc0f9dee

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:24 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
13886
content-type
multipart/form-data
recaptcha__en.js
www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/ 		343 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7511f403bc5d8cdd240bbdb02c5848775e0f89f6dd952e70675d22fd434e1b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 16:28:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
60011
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
137335
x-xss-protection
0
last-modified
Mon, 15 Nov 2021 05:04:02 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin-allow-popups; report-to="recaptcha"
expires
Tue, 29 Nov 2022 16:28:13 GMT
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 17:51:16 GMT
content-encoding
gzip
age
9127029
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
Gjv2idiwkMc96f3AeRQeXbnLFPEfbTApzgUoycY-SfLHNYvcAFnM7w==
bl-f821a95-b3283f4c.js
tagan.adlightning.com/math-aids-threatpost/ 		49 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-f821a95-b3283f4c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b4c7705e3fb3524673ae02c21a55242d92724c6b62e3f3a0ad42fd124cb06dab

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 19:12:44 GMT
content-encoding
gzip
age
309341
x-cache
Hit from cloudfront
content-length
20713
x-amz-meta-git_commit
f821a95
last-modified
Fri, 26 Nov 2021 19:03:51 GMT
server
AmazonS3
etag
"1d3cdc6322495f3eb58e525ad20d3561"
x-amz-version-id
n4Umr6WNCKD5ZemA4L2n9bosJvq2VKm5
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
XFgdZN717RTOcJkxe-yLfH8YVLxvmI-Sl_Mim3k6l10BltA60RKJ6A==
pubads_impl_2021111601.js
securepubads.g.doubleclick.net/gpt/ 		344 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
sffe /
Resource Hash
3eee78aaf4f9dc8d0d36d3dddbaad9094ace5d91611f9aee6fe0b44b0ed46ccc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
118471
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 09:34:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 30 Nov 2021 09:08:25 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		115 B
727 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=threatpost.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
bb66dbe2867f4bd08186615c104fefef105858870dd23550d3fd33100115f4e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
91
x-xss-protection
0
expires
Tue, 30 Nov 2021 09:08:25 GMT
config
c.amazon-adsystem.com/cdn/prod/ 		0
0
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.198.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-198-4.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
gYbY2ORQY5Qmsyt0ob0SiGH6tjIhuo4B
content-encoding
gzip
etag
W/"a4d296427fc806b21335359e398c025c"
age
36670
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Tue, 09 Nov 2021 22:55:20 GMT
server
AmazonS3
date
Mon, 29 Nov 2021 23:52:16 GMT
vary
Origin
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
j7KwzYvek-6grJBF71jSGNAkh72S_LScFNaA8LHUz2hPXLnwe2VoZw==
vendor-list.json
qd.admetricspro.com/js/cmp2/ 		256 KB
38 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:cf70 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Mon, 31 May 2021 16:54:38 GMT
server
cloudflare
etag
W/"3ffae-5c3a314b5dcb2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mzv%2Bs%2Bk0MOM%2FCY45XbqbmO%2BCo%2Bf1TAt4egPwBx%2BLLkL%2FzZlSU3T0TnZj18MRdSIqIiQOVEf1aziKRVeH0tHLHURd1tatNMUYe5khgu8%2FCvdYMXSCrRN4qxju5aLg3lCaoTUzpsqw%2FBvtpGR%2BCJkWclzH"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=600
cf-ray
6b62ee597cd03748-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires
Tue, 30 Nov 2021 09:18:25 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
438
date
Tue, 30 Nov 2021 09:01:07 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 30 Nov 2021 11:01:07 GMT
quant.js
secure.quantserve.com/ 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:ee05:6a01:4b41:8c89 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
487fce51fd801415c362f3f9f2df43c445a4b9ba38f9b6d49dfc898dc85ede94

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
etag
"FMCWFRCBdbNj8Eh2c0G78Q=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Tue, 07 Dec 2021 09:08:25 GMT
uwt.js
static.ads-twitter.com/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
last-modified
Mon, 20 Sep 2021 23:58:10 GMT
etag
"8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
5410
x-served-by
cache-iad-kcgs7200078-IAD, cache-fra19130-FRA
flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 		236 B
565 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:33 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48379-ec"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
236
x-amz-cf-id
5qLgbMG7f2dCgdCCiLYSDR7ZpUVMCOVNPRHQPWOd8Jlw_vFHKfgHsw==
fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:fa00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=a6d9acd7
Origin
https://threatpost.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
last-modified
Mon, 29 Nov 2021 07:38:33 GMT
server
nginx
x-amz-cf-pop
FRA2-C1
etag
"61a48379-12d68"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
77160
x-amz-cf-id
VN8YrSH0H7rcs3QlvXSqMxPvTXP36jvNpg0RaRXnA3X9SoElz1TzUQ==
v1
geo.ipify.org/api/ 		332 B
554 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.140.160.2 Ogden, United States, ASN18450 (WEBNX, US),
Reverse DNS
threatintelligenceplatform.com
Software
nginx /
Resource Hash
d2998b11dcbfb3acff62edea1993a71590d7b67463d57d0a18a268978bd1297e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:30 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, private
Transfer-Encoding
chunked
Connection
keep-alive
blockedDomains_3.bin
lit.connatix.com/08d79ac9-d151-59b7-8ffc-1666f862d246/ Frame 42CC 		81 B
321 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lit.connatix.com/08d79ac9-d151-59b7-8ffc-1666f862d246/blockedDomains_3.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
be3ba2f86654b73dda7d39ed448c90628092498372215fffe2281e0b587a62dc

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
last-modified
Wed, 29 Sep 2021 13:27:38 GMT
age
4073222
etag
"6a19519ac776603343ae0285e9d02606"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
85
sr
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/sr?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:24 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
sffe /
Resource Hash
eaddadb4dd24a0484fdda36517daec40d53cca4cf2d144329c97c0bedb50c8ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1059 / 585 of 1000 / last-modified: 1637708807"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26771
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 30 Nov 2021 09:08:25 GMT
2_media.bin
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 42CC 		291 B
492 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/2_media.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
19a7659a2a48aa5c299dee1ac14bc4d9a47f3be58010ae2ad753509a797d6b76

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
last-modified
Wed, 10 Nov 2021 16:13:50 GMT
age
1015622
etag
"c5803ee4c3208fe24e60d942fd37bd5a"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
255
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 42CC 		368 KB
123 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
014f2fb8d253cee4da7966e085bf836310d85793e5ab4291489a6add2b123e6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
125138
x-xss-protection
0
expires
Tue, 30 Nov 2021 09:08:25 GMT
1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
br
age
1048760
etag
"CDlq0wWU2N6Hha9Y1OkqKS7K/JyWAUvXYL5GlZ2se8g"
access-control-max-age
86400
fastly-io-info
ifsz=8114 idim=288x42 ifmt=png ofsz=6487 odim=288x42 ofmt=png
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/png
content-length
6487
rules-p-_7kVx0t9Jqj90.js
rules.quantcount.com/ 		2 B
354 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:3200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:05:51 GMT
via
1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
server
AmazonS3
age
153
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
cross-origin-resource-policy
cross-origin
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA2-C1
content-length
2
x-amz-cf-id
fgzTSxPYmv1ZHUQg3PNBzlQCgP7m1NtZrPzoC7n2RUCAJcvtqDRByQ==
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=2060504824&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&ul=en-us&de=UTF-8&dt=IKEA%20Hit%20by%20Email%20Reply-Chain%20Cyberattack%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1912922262&gjid=1710244569&cid=1305287818.1638263305&tid=UA-35676203-21&_gid=1269496969.1638263305&_r=1&gtm=2wgba1PM29HLF&z=374298734
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:25 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&aip=1&a=2060504824&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&ul=en-us&de=UTF-8&dt=IKEA%20Hit%20by%20Email%20Reply-Chain%20Cyberattack%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=1305287818.1638263305&tid=UA-35676203-21&_gid=1269496969.1638263305&gtm=2wgba1PM29HLF&z=1345657216
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 29 Nov 2021 11:28:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
77983
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ao
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ao?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:25 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
g
capi.connatix.com/rtb/ Frame 42CC 		4 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/rtb/g?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
ccaf0448a586586e14ac4d5d046d363cf7902eb3ddeea41494ab702d29f0d2e9

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:25 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
4191
content-type
multipart/form-data
ps
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ps?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:25 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
1_th.jpg
img.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6daa27fedbf78fddf32e3fdfada60642a83bb9b1bf4eb996e71f2010a9dd3861

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
br
age
1026402
etag
"SxSWjca7k4nctj/h0NXUCMaqKQ/LM66C1zSukVtV8PA"
access-control-max-age
86400
fastly-io-info
ifsz=76994 idim=2560x1440 ifmt=jpeg ofsz=7623 odim=400x225 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7187
adsct
analytics.twitter.com/i/ 		31 B
674 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=ae95e0fe-f44b-40dc-91ab-ef09cd2e8e32&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
108
pragma
no-cache
last-modified
Tue, 30 Nov 2021 09:08:25 GMT
server
tsa_f
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
07dbf64fe27df1bba04adc117e6435ab18488b05e74f99915fd21f342511ca1a
x-transaction
2888dac356a1cfbc
expires
Tue, 31 Mar 1981 05:00:00 GMT
adsct
t.co/i/ 		43 B
470 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=ae95e0fe-f44b-40dc-91ab-ef09cd2e8e32&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
107
pragma
no-cache
last-modified
Tue, 30 Nov 2021 09:08:25 GMT
server
tsa_f
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
de4d5fad44a74093b813ef0b7290dec2a6451502e311aca4733739e90d4bd097
x-transaction
28570ec5f35de3c4
expires
Tue, 31 Mar 1981 05:00:00 GMT
prebid4.43.0-2.js
cds.connatix.com/p/plugins/ Frame E95F 		376 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6c9a29d5877620bf729f6920b50466df6e2635d6cf6a7b3dd7bc7ec4f361bda4

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
br
last-modified
Thu, 07 Oct 2021 08:28:44 GMT
age
3632664
etag
"d670a030e44b22136be6fe4a4f92f047"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
105730
playlist.m3u8
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 42CC 		279 B
240 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/playlist.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
34d7bb2bbd510d29cad7fcf49e89b9f0c2443c09ccfe5b61cdc436522c4ed0ec

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
last-modified
Wed, 10 Nov 2021 16:13:50 GMT
age
1022378
etag
"555aab791eaac4ba5ce5f5b879cbef64"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
155
bid
c.amazon-adsystem.com/e/dtb/ 		64 B
530 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&pid=vuB8eQOGdm9dm&cb=0&ws=1600x1200&v=7.71.1&t=2000&slots=%5B%7B%22id%22%3A%22Amazon_400x225%22%2C%22mt%22%3A%22v%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdprl=%7B%22status%22%3A%22tcfv2-timeout%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.198.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-198-4.fra2.r.cloudfront.net
Software
Server /
Resource Hash
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 e86025dac63232624d2273c5fd256ce4.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA2-C1
x-amz-rid
1CJZ2DAKA19Q13Z0M5KW
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
64
x-amz-cf-id
zINT2aS_wobf2jEOax-WOkDnvgk3nbkqsk6Ru57XgEryEUkSmxsC2A==
collect
stats.g.doubleclick.net/j/ 		7 B
444 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-35676203-21&cid=1305287818.1638263305&jid=1912922262&gjid=1710244569&_gid=1269496969.1638263305&_u=YEBAAEAAAAAAAC~&z=1528536473
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3c25b077a6d92cd9d3576660b68c4c0bd135b78b3cd3b66491ff2c7aa0eeaad3
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 30 Nov 2021 09:08:25 GMT
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7
expires
Fri, 01 Jan 1990 00:00:00 GMT
0.m3u8
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 42CC 		658 B
357 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/0.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
86b3dce72c0a030f3fdf90546b371635abdf4ca8b78bc138057640af63109542

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
last-modified
Wed, 10 Nov 2021 16:13:49 GMT
age
1022376
etag
"56861437fd85afb4b5a24d44c95883c8"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
265
0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/0.mp4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Tue, 30 Nov 2021 09:08:25 GMT
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
access-control-allow-origin
*
content-length
0
0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 42CC 		855 B
946 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b126e085011449d4c30f74a325e37b19c7d0bc4b73a06b16c97dfa9ad98d3cd4

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Range
bytes=0-854

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
last-modified
Wed, 10 Nov 2021 16:13:49 GMT
age
1022374
etag
"f22936b9547b7a633cefb4f92e4b1891"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 0-854/2202506
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
855
localstore.js
script.4dex.io/ 		483 B
943 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/localstore.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1035449
x-amz-request-id
tx24904699bb274cfc93012-0061961d50
x-amz-id-2
tx24904699bb274cfc93012-0061961d50
last-modified
Thu, 18 Nov 2021 09:29:40 GMT
server
cloudflare
etag
W/"922cffdd75f7192f75231d92684885aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n6UMDIVPHSXnXKSczESKiHnlyZ0zrh0C95rUrax3teoMbYw%2F%2B43mTT3y3XWC7hFfZGovSsbSLMTtkmdnTYSMJNRuV%2F%2F077dYs7y2pSHnPNhb5%2BmBEPwqaJQhB0CmvB1oiv0WvWaB8SGGPF39"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=1800
x-amz-version-id
1637227780937425
cf-ray
6b62ee5e2fdd5a07-MXP
724.json
id5-sync.com/g/v2/ 		213 B
532 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/724.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.36.109.22 , France, ASN16276 (OVH, FR),
Reverse DNS
p09.id5-sync.com
Software
/
Resource Hash
923272d509c82dee64f700fd96330fbce677d0e1b12b2490f0efb37a5c08702f
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://threatpost.com
Date
Tue, 30 Nov 2021 09:08:17 GMT
Access-Control-Allow-Credentials
true
Vary
Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
bid
c.amazon-adsystem.com/e/dtb/ 		64 B
531 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&pid=vuB8eQOGdm9dm&cb=1&ws=1600x1200&v=7.71.1&t=1200&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-6794670-2%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-3%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-5%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-1%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.198.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-198-4.fra2.r.cloudfront.net
Software
Server /
Resource Hash
8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:25 GMT
via
1.1 e86025dac63232624d2273c5fd256ce4.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA2-C1
x-amz-rid
JMEG5DZ6ZXRRZY51H8S2
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
64
x-amz-cf-id
yyDxWyzHaSlGetuJZ0Jseackiwrky7GhkJ2UQiR9CPg1VX4X9J6n9A==
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
https://threatpost.com
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1559
date
Tue, 30 Nov 2021 09:08:25 GMT
content-encoding
gzip
vary
Accept-Encoding
sid
mug.criteo.com/ Frame E95F
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1
  • https://mug.criteo.com/sid?cpp=F8xJlnxBUDZtZ2RxbnB1dkptYmFEREtMUkc1ak1NWmpzRnltdjk4UlhmWmF6eDJFTUNXMXg4QzRmOCtWaWYyVERGT2R0d0xhM3ZiWi9qdjllSDluVVRrMUNTVzJPQXlqald6elRIQk5mMVlsbHVoS0YzdkxEbDJZbWF0U0...
339 B
600 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=F8xJlnxBUDZtZ2RxbnB1dkptYmFEREtMUkc1ak1NWmpzRnltdjk4UlhmWmF6eDJFTUNXMXg4QzRmOCtWaWYyVERGT2R0d0xhM3ZiWi9qdjllSDluVVRrMUNTVzJPQXlqald6elRIQk5mMVlsbHVoS0YzdkxEbDJZbWF0U0VxaS9pMC9ZdHcyckY4QWZnUGlGMmVzWGcwV29DTnpwcDFxdFhEVzA5aVFNNC9kS1JxaHYrOUlobEJsalA3MU1ydCtWTEVmb2xsODRqUTZKNDBTVEQyTS92UjdXWG14OHpkbXB5YU41VllSQ0x0Zzg5d3NVPXw&cppv=2
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
d957bd6a5deeb84b126f1aeea3a480684705dfae6c660f1acd822d71d5621092
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Tue, 30 Nov 2021 09:08:26 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1757
expires
0

Redirect headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Tue, 30 Nov 2021 09:08:25 GMT
location
https://mug.criteo.com/sid?cpp=F8xJlnxBUDZtZ2RxbnB1dkptYmFEREtMUkc1ak1NWmpzRnltdjk4UlhmWmF6eDJFTUNXMXg4QzRmOCtWaWYyVERGT2R0d0xhM3ZiWi9qdjllSDluVVRrMUNTVzJPQXlqald6elRIQk5mMVlsbHVoS0YzdkxEbDJZbWF0U0VxaS9pMC9ZdHcyckY4QWZnUGlGMmVzWGcwV29DTnpwcDFxdFhEVzA5aVFNNC9kS1JxaHYrOUlobEJsalA3MU1ydCtWTEVmb2xsODRqUTZKNDBTVEQyTS92UjdXWG14OHpkbXB5YU41VllSQ0x0Zzg5d3NVPXw&cppv=2
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1820
content-length
482
expires
0
cygnus
htlb.casalemedia.com/ Frame E95F 		36 B
330 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?t=900&s=435870&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%22158ef5235bc3ec%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%224.43.0%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22dms%22%3Atrue%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221005%22%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%222ac12b87d0b746%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%2C%22fl%22%3A%22x%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22skip%22%3A1%2C%22skipmin%22%3A31%2C%22skipafter%22%3A5%2C%22placement%22%3A1%2C%22w%22%3A400%2C%22h%22%3A225%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%7D
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-84-150.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f6c82d319fe2b88dbb0cbb560ca58059b114344df3757d9dd53ae7afb7ac59d8

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
x-ak-initial-geo
CC:[GB], RC:[EN], CN:[EU], CIP:[89.238.142.215], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
27
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
36
x-ak-client-geo
27
expires
Tue, 30 Nov 2021 09:08:26 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame E95F 		106 B
509 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=0b240d61-4987-4dba-a432-29ed3555f3f8&nocache=1638263305297&gdpr=0&pubcid=91b9888f-14db-4f72-9384-625b48a25151&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540882779&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
via
1.1 google
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
mvo
tag.1rx.io/rmp/233148/0/ Frame E95F 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233148/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:25 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
translator
hbopenbid.pubmatic.com/ Frame E95F 		0
115 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:25 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
ads.adaptv.advertising.com/rtb/ Frame E95F 		0
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.193.57.131 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-57-131.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
mvo
tag.1rx.io/rmp/216476/0/ Frame E95F 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216476/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:25 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
avjp
teachingaids-d.openx.net/v/1.0/ Frame E95F 		106 B
297 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=7272f779-e2ba-493b-af01-4af982768b7f&nocache=1638263305308&gdpr=0&pubcid=91b9888f-14db-4f72-9384-625b48a25151&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C96518702-0be9-4648-b4f6-83ff0e1ed3e7%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540882778&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
via
1.1 google
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
mvo
tag.1rx.io/rmp/216475/0/ Frame E95F 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216475/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:25 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
prebid
ib.adnxs.com/ut/v3/ Frame E95F 		5 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0282fd1663bd83710f0b9e7f47496198d34ca63deb4c60ce0bcdd88be875bd57
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
f535c140-4477-4a0e-a249-3fdc91f3722d
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame E95F 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:24 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame E95F 		0
0
c
prebid.a-mo.net/a/ Frame E95F 		0
378 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:25 GMT
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
server
envoy
x-envoy-upstream-service-time
220
vary
origin, Accept-Encoding
mvo
tag.1rx.io/rmp/233098/0/ Frame E95F 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233098/0/mvo?z=1r&hbv=4.43,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:25 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
cygnus
htlb.casalemedia.com/ Frame E95F 		37 B
331 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?t=900&s=435871&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%22270c56759ca87aa%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%224.43.0%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22dms%22%3Atrue%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221005%22%2C%22rid%22%3A%2296518702-0be9-4648-b4f6-83ff0e1ed3e7%22%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2228193815be54b3f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%2C%22fl%22%3A%22x%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22skip%22%3A1%2C%22skipmin%22%3A31%2C%22skipafter%22%3A5%2C%22placement%22%3A1%2C%22w%22%3A400%2C%22h%22%3A225%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%7D
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-84-150.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7dd7b548955c22cf3c2d3c978dd4aa416822dc15a4f65ab019159d9da689c628

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
x-ak-initial-geo
CC:[GB], RC:[EN], CN:[EU], CIP:[89.238.142.215], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
27
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
27
expires
Tue, 30 Nov 2021 09:08:26 GMT
bridge3.489.0_en.html
imasdk.googleapis.com/js/core/ Frame E344 		580 KB
190 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
194780
date
Tue, 30 Nov 2021 07:36:34 GMT
expires
Wed, 30 Nov 2022 07:36:34 GMT
last-modified
Thu, 11 Nov 2021 23:22:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
5511
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
client.js
s0.2mdn.net/instream/video/ Frame 42CC 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16746
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 09:08:26 GMT
bridge3.489.0_en.html
imasdk.googleapis.com/js/core/ Frame DED0 		580 KB
190 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
194780
date
Tue, 30 Nov 2021 07:36:34 GMT
expires
Wed, 30 Nov 2022 07:36:34 GMT
last-modified
Thu, 11 Nov 2021 23:22:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
5511
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.489.0_en.html
imasdk.googleapis.com/js/core/ Frame 8D1A 		580 KB
190 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
194780
date
Tue, 30 Nov 2021 07:36:34 GMT
expires
Wed, 30 Nov 2022 07:36:34 GMT
last-modified
Thu, 11 Nov 2021 23:22:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
5511
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pixel;r=711126772;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F;uht=2;fpan=1;fpa=P0-1060906429-1638263305420;pbc=91b9888f-14db-4f72-...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=711126772;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F;uht=2;fpan=1;fpa=P0-1060906429-1638263305420;pbc=91b9888f-14db-4f72-9384-625b48a25151;ns=0;ce=1;qjs=1;qv=92a3679b-20211110211611;cm=;gdpr=0;us_privacy=1---;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=0;et=1638263305420;tzo=0;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2021%2F11%2F29155618%2Fikea-%2Ctype.article%2Ctitle.IKEA%20Hit%20by%20Email%20Reply-Chain%20Cyberattack%2Cdescription.IKEA%252C%20king%20of%20furniture-in-a-flat-box%252C%20warned%20employees%20on%20Friday%20that%20an%20ongoin%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fikea-email-reply-chain-attack%2F176625%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:ee05:6a01:4b41:8c89 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:25 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-35676203-21&cid=1305287818.1638263305&jid=1912922262&_u=YEBAAEAAAAAAAC~&z=463578954
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.co.uk/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.uk/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-35676203-21&cid=1305287818.1638263305&jid=1912922262&_u=YEBAAEAAAAAAAC~&z=463578954
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
v2
e.serverbid.com/api/ 		711 B
984 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://e.serverbid.com/api/v2
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:26 GMT
access-control-allow-credentials
true
content-length
711
vary
Origin
content-type
application/json
c
prebid.a-mo.net/a/ 		0
260 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:26 GMT
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
server
envoy
x-envoy-upstream-service-time
225
vary
origin, Accept-Encoding
arj
teachingaids-d.openx.net/w/1.0/ 		173 B
383 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=b03e61a7-1fa9-4535-bf30-3bc5a7e4ef6a%2Cb03e61a7-1fa9-4535-bf30-3bc5a7e4ef6a%2C23054897-ec0c-4e35-8cd7-b2e0611faa5a%2C97220bbf-fad4-4c63-9905-7b301a6da29c%2C97220bbf-fad4-4c63-9905-7b301a6da29c&nocache=1638263305440&gdpr=0&x_gdpr_f=1&pubcid=91b9888f-14db-4f72-9384-625b48a25151&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divids=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&aucs=%252F22404337467%252C21707124336%252Fthreatpost-970x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-970x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x600-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x600-ATF&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
0677254f4a0ea43f98f13acb5be0a4bc75c35f84fa3258a5b3b583400fd32fb6

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
v1
btlr.sharethrough.com/universal/ 		0
113 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.124.10.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-10-167.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:26 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
112 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.124.10.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-10-167.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:26 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
112 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.124.10.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-10-167.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:26 GMT
access-control-allow-credentials
true
vary
Origin
bid
ap.lijit.com/rtb/ 		94 B
741 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.17.0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
cdf0abe24bcec26c606449634600434f84a6d826067060c32fcf824e92fc20e0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap2ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
98
prebid
mp.4dex.io/ 		99 B
478 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mp.4dex.io/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29dded85a6035878b3169ce914a487d322fc4522745876a722c0dea0e91c6c53
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
x-warn
Selecting bids. No selected bids
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
strict-transport-security
max-age=63072000
cf-ray
6b62ee5f581d59ad-MXP
server
cloudflare
expires
0
prebid
ib.adnxs.com/ut/v3/ 		12 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
157459c2040ec5edadc0c7da7f8573a887685b9d03c805f2d7bc71a5ff11e285
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
e3b883e2-a375-4aa7-9eb2-738aed405958
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
291 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_728x90-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
3a906d42aaff31831323f59efb6087c53bc1a1e91ffd1472cc4dd689b1d6a32f

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_300x250-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
cecb2c2a724e47b0cfa0e322f06f4f3b3bb8704df277e114fefb38cca8f9b327

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_300x600-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
3461118e510cfe52c4a49e235e5a40b44827c51e3d08fbed0a5cad23860fdbdd

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
cygnus
htlb.casalemedia.com/ 		37 B
331 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22379ba2233e11dfe%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F%22%2C%22ref%22%3A%22https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F%22%2C%22domain%22%3A%22threatpost.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22threatpost.com%22%7D%2C%22keywords%22%3A%22Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A4%2C%22msi%22%3A4%2C%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%225.17.0%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2238eae2976640be6%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22970x90%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2239501c1e42b925%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%2C%22sid%22%3A%22336x280%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%22405230c9d19c3b3%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%2C%22sid%22%3A%22300x600%22%7D%7D%5D%7D%7D%5D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-84-150.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7ba6ef89c5671ecd4d87c9db7d69c6297a2c7effbbde218210e9f05834ab34e4

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
x-ak-initial-geo
CC:[GB], RC:[EN], CN:[EU], CIP:[89.238.142.215], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
27
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
27
expires
Tue, 30 Nov 2021 09:08:26 GMT
auction
tlx.3lift.com/header/ 		19 B
263 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=5.17.0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tmax=1200&gdpr=false
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.85.35 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-85-35.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
content-type
application/json; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		567 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-970x250-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-970x250-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=b03e61a7-1fa9-4535-bf30-3bc5a7e4ef6a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.516198292351296
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
d87bc257689ca319d79f6ea869dd7f94e90888d3697e0108c792f41f79c47f68

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:26 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
567
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		565 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x250-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x250-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=23054897-ec0c-4e35-8cd7-b2e0611faa5a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.0869894150551207
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
33276bcdad0da0460a5fffc12621ba9d2530b7dd3aa10033f57fb2235478df14

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:26 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
565
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		565 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=97220bbf-fad4-4c63-9905-7b301a6da29c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9688921470232963
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
f6378ff18eb8324cba4838e6521c9d7203d289ca6cbe9caa8a992b56b8c55055

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:26 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
565
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		565 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=97220bbf-fad4-4c63-9905-7b301a6da29c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6057241509505151
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
0782733c5b6813af4d02fb3818a2aa92f713e37f4cd9a311f7df83217d316315

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:26 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
565
Expires
Wed, 17 Sep 1975 21:32:10 GMT
adreq
ads.servenobid.com/ 		650 B
628 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.servenobid.com/adreq?cb=6351
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
f71c80526dc54d8ca51c95af37b6c7c0039d4bc5b0bf47f27900d9311312becc

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
amp-access-control-allow-source-origin
*
vary
accept-encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
mvo
tag.1rx.io/rmp/216477/0/ 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216477/0/mvo?z=1r&hbv=5.17,2.1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
translator
hbopenbid.pubmatic.com/ 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:24 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ 		11 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
8a8631e38e3fba962e873727e47a296556212b958b54b160ec8ef178d2563f37
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
abf3f726-84b0-45c2-aaf9-3ba14df98cb1
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 42CC 		234 KB
234 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c08b7fca7d996af22d34e4132379beee7691e435c7859b6a717669b364889b3d

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Range
bytes=855-240787

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
last-modified
Wed, 10 Nov 2021 16:13:49 GMT
age
1022374
etag
"f22936b9547b7a633cefb4f92e4b1891"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 855-240787/2202506
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
239933
0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/0.mp4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Tue, 30 Nov 2021 09:08:26 GMT
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
access-control-allow-origin
*
content-length
0
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 24EC 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2771
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 30 Nov 2021 09:22:15 GMT
integrator.js
adservice.google.com/adsid/ Frame 42CC 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 2AA8 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2771
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 30 Nov 2021 09:22:15 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame C7E5 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2771
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 30 Nov 2021 09:22:15 GMT
cache
prebid.adnxs.com/pbc/v1/ Frame E95F 		63 B
324 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.adnxs.com/pbc/v1/cache
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.252.161.190 Southall, United Kingdom, ASN29990 (ASN-APPNEX, US),
Reverse DNS
prebid.ams1.adnexus.net
Software
nginx/1.19.0 /
Resource Hash
225c29df4c703303a08e31089905ffedf5b3e50419468908176b8179a0e69d59

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Server
nginx/1.19.0
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
63
adagio.js
script.4dex.io/ 		71 KB
22 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/adagio.js
Requested by
Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8854752a74f17180183321d2dba6179fda1d37cd626d436d2236dfb797e57fb8

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1035366
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-request-id
tx90d370cc27984a5e9438c-0061961d5d
x-amz-id-2
tx90d370cc27984a5e9438c-0061961d5d
last-modified
Thu, 18 Nov 2021 09:29:40 GMT
server
cloudflare
etag
W/"ade00d0c7876260b60ee0cd4912d02bc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kLAjoSiMCoHVoJV7kyF9mu2KmLOXYBTW9rhGg%2BQEa008erydUCf%2BikduTFPY5ORvdp%2BanXoDlDO%2F6oN8bqeNb2V9OUhI%2FmKLmTbU7c%2BEJqI44pdRH%2B4Ff0oSxlGSXeci%2FCK7UU%2BgV3w2qwNa"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=1800
access-control-allow-credentials
true
x-amz-version-id
1637227779984125
cf-ray
6b62ee602a533751-MXP
access-control-allow-headers
Authorization
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=F8xJlnxBUDZtZ2RxbnB1dkptYmFEREtMUkc1ak1NWmpzRnltdjk4UlhmWmF6eDJFTUNXMXg4QzRmOCtWaWYyVERGT2R0d0xhM3ZiWi9qdjllSDluVVRrMUNTVzJPQXlqald6elRIQk5mMVlsbHVoS0YzdkxEbDJZbWF0U0VxaS9pMC9ZdHcyckY4QWZnUGlGMmVzWGcwV29DTnpwcDFxdFhEVzA5aVFNNC9kS1JxaHYrOUlobEJsalA3MU1ydCtWTEVmb2xsODRqUTZKNDBTVEQyTS92UjdXWG14OHpkbXB5YU41VllSQ0x0Zzg5d3NVPXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
null
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
null
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
986
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
vary
Accept-Encoding
0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/0.mp4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

retry-after
0
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Tue, 30 Nov 2021 09:08:26 GMT
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
access-control-allow-origin
*
content-length
0
0.mp4
vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ Frame 42CC 		186 KB
186 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ec64e6317144633c523be2052da645ca9973e87839fef4f3f0b29748d72dcedc

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Range
bytes=240788-430989

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
last-modified
Wed, 10 Nov 2021 16:13:49 GMT
age
1022375
etag
"f22936b9547b7a633cefb4f92e4b1891"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 240788-430989/2202506
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
190202
g
capi.connatix.com/rtb/ Frame 42CC 		2 B
246 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/rtb/g?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
ffdbea2a5a9959ea5f9809139a0178c725fa9474a88f1cfe10f702bdb35c3cc0

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:25 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
2
content-type
multipart/form-data
mq
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/mq?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:25 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
cache
prebid.adnxs.com/pbc/v1/ Frame 42CC 		4 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.adnxs.com/pbc/v1/cache?uuid=03806a36-da8c-4e3c-9436-22332161c22b
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.252.161.190 Southall, United Kingdom, ASN29990 (ASN-APPNEX, US),
Reverse DNS
prebid.ams1.adnexus.net
Software
nginx/1.19.0 /
Resource Hash
211e301c21dbd59e8385d89e4dd5533d8dacf32ef8a918decb9d87e364ac9da8

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Content-Encoding
gzip
Server
nginx/1.19.0
Vary
Accept-Encoding, Origin
Content-Type
application/xml
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Transfer-Encoding
chunked
integrator.js
adservice.google.co.uk/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.co.uk/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		165 KB
46 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1960138878124635&correlator=3774990211269090&output=ldjh&impl=fifs&eid=31063812&vrg=2021111601&ptt=17&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&sc=1&sfv=1-0-38&ecs=20211130&iu_parts=22404337467%3A21707124336%2Cthreatpost-970x250-ATF%2Cthreatpost-300x250-ATF%2Cthreatpost-300x600-ATF%2Cthreatpost-2x2-Skin%2Cthreatpost-AdX-Interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2%2C1x1&ists=1&fas=0%2C0%2C0%2C0%2C8&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_oftmedia%3D685c3fa750f4638%26hb_bidder_oftmedia%3Doftmedia%26dyn_bids%3D0.00%26hb_adid%3D685c3fa750f4638%26hb_bidder%3Doftmedia%7Camznbid%3D2%26amznp%3D2%26hb_adid_appnexus%3D69be3c8f0113618%26hb_bidder_appnexus%3Dappnexus%26dyn_bids%3D0.00%26hb_adid%3D69be3c8f0113618%26hb_bidder%3Dappnexus%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fikea-email-reply-chain-attack%252F176625%252F%26urlquery%3Dgoogfc%26contentid%3D176625%26category%3Dmalware-2%26contenttags%3D&cookie_enabled=1&bc=31&abxe=1&lmt=1638263305&dt=1638263305953&dlt=1638263303110&idt=1941&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C1082%2C1082%2C0%2C-9&adys=8%2C166%2C1186%2C8%2C-9&adks=4166723991%2C1414505084%2C1356251026%2C3771495681%2C2643643476&ucis=1%7C2%7C3%7C4%7C5&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x0%7C300x0%7C300x0%7C1600x0%7C0x-1&msz=728x0%7C300x0%7C300x0%7C1600x0%7C0x-1&ga_vid=1305287818.1638263305&ga_sid=1638263306&ga_hid=2060504824&ga_fc=true&fws=0%2C0%2C0%2C0%2C2&ohw=0%2C0%2C0%2C0%2C0&btvi=0%7C0%7C0%7C0%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
c77abaa324e43b2ac70617309fb60582931602391e69484088fed7081f3b5483
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47005
x-xss-protection
0
google-lineitem-id
-1,-1,-1,-2,-1
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-1,-1,-1,-2,-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		12 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021111601&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f63e14b637e1b3d523ac5fa3d716f0e7fcf4e0b1d5ba1c2d676ea83a1b89aad3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9199
x-xss-protection
0
container.html
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CF2F 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Tue, 30 Nov 2021 09:08:26 GMT
expires
Wed, 30 Nov 2022 09:08:26 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pubads_impl_page_level_ads_2021111601.js
securepubads.g.doubleclick.net/gpt/ 		36 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2021111601.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
sffe /
Resource Hash
5130eb2b26589edc79df541561e0c40469fdb05a7a75566a61e580e1d473254e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13503
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 09:34:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 30 Nov 2021 09:08:26 GMT
ab
ams1-ib.adnxs.com/ Frame 42CC
Redirect Chain
  • https://ams1-ib.adnxs.com/vast_track/v2?info=agAAAAMArgAFAQkK6qVhAAAAABFN2FLvE44pehkJ6qVhAAAAACCU5e6SASgAMJ8XOOc3QMyyYUjD6pcCUJ-ZpQhYvY0HYgJHQmgBcAF4AIABAogBAZABkAOYAeEBoAEAqAGU5e6SAbABAQ..&s=7c5eb...
  • https://ams1-ib.adnxs.com/ab?ro=1&an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QKLEugLCQAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9iOYS4nmD0ARSupY...
11 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ams1-ib.adnxs.com/ab?ro=1&an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QKLEugLCQAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9iOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SACkRJNgxAAAA4HoU_j8wn5mlCDjnN0CfF0i3AVCU5e6SAVjLj3pgAGjnpakBeLKQBYABAYoBA1VTRJIBAQb0hAiYAQGgAQGoAQGwAQC4AQPAAQXIAQLQAQDYAQDgAQDwAQDYAtNH4ALX9zfqAjxodHRwczovL3RocmVhdHBvc3QuY29tL2lrZWEtZW1haWwtcmVwbHktY2hhaW4tYXR0YWNrLzE3NjYyNS_yAoMNCghJTVBfREFUQRL2DGhCMVRoWmNHLUpRN0lKc1Z2aUs5TkdxanRPTm9hR2Z1T2hOSkhKVHMyaEJXX0lEdmNEN3N6dTNpRUw0cjV5UXdDdHR4Zl9WTC1jNE95b3lNYy1qZGVyZ1ExX2IxZXFJS0JmcURFVk1uYlBmQjFjb0xWRDhLOHlsS1dpaWVsMXlIdmxXdEZNREN1NXlaRlBIaDdPaEZfOE1tNG1Gdk9tQ2R0LUFXdHVYWThGSjZ6YWdIMDI0YVRCeEdsYmhaWTB4S0RPNjB3QURsUlBQU2V2c3I0QlZHakx0eldpZC1HamhTRzJwYXNCallvQVpWUm42VG5IbkgxZ3JRbHlBc3RWdnltbFNKbktEWjgxU1ZGQ2paRG5jdV9lWk90Tmcta1BlWUlXUEdhMTlxczdVYVY0WDJQYXdXaERmSHhDR2s4NWtmT3JuTm5GcW5DSXhZdmE3Y1kwRndLUVg4REFKQ1lBSkM2Z1UxdVN0ZnktenVFQ2ZabHNBR0F2UDJGUW8wazhXVWtJSDExUVFOYVhUSUZSam1RbFhULTlxRzJROFdPVHBVSDZwNkhhQ2QyNFFDUHJJWFBna3B2ZDNROGtTdEVUb21tLUY3ZHplTUU0MWtSeGl0dGtOZExyeVpTYTVjM2JPUmNzeURzSEk3bldoWVlhVHV5YWJ4cVhKUXIxeDRVd0h3cEJoV1RuTzR4QnIxX211MFBfcmxmRVpoZmdZQkRDeFZUVk1TQm5LMWwzTnBYdHNfWWE2LWRqcTF0eTNISERna29xSWJ4RklVbzZDbnMyZ2dwRjFWWnBuMndiV3FfLUZ2X3dabGVzazVmY2pYckMwazBPQWdWNExTRmd2U3luUUMyVFhvaXAteVEyQkVBNzdodF9GdWxvdFRFR1AtSG1mUTQ5S0QwTllwdjlORDBXR2ZJN2kwZ0lWVVdqWnhZTjZWSnRaTFJzaHJpUUJrLVJGLU1KZURrcHV4Y21xbUcyaVRtbnpBQzF4RGxpQ2xScDV3OVpNNldFNDlyS044MzJuTkVicGFiSzM0WERhXzR5Y3hSdlJhTmE4T0prNlJpNU4xX21NajRmZVVCX2dnNmliQ3JVbGpQSmUwdlcyd2xrZHMxLU1ONVhxaExIMGMzUkZyZnZzazZfX2Y1RzdBYnp6YU8tTXhMRUh4M2E0TlNrYzlxVkJvTVhyMXYyZFhiWGVsN01xOFJaZXF0Mno2dmJyT3FLN1VrN1had3QzZmpMN0s1ZjEyUnVYVkhjREZ0Z2dJMVBVUWFTUWhvX01pd0lGdkpLeHFUeFRjRHFVY1RURHpyOUdMYk1WNmtKcG4zWC16aTVORHZQRmxZaXM2OUZpV3lpejVFdUF5VUhmR04yMUx4RG5KbjdfdHZWb18xLW9PejJqUzJHX285MXN5bzRzeWZlcW1HUzFoM1ZGWGFtTHZ4aXcyNG51MTVieUExeF9IRlBhWWoyOGFrWV9rMjVOSGpuLXc3VG1ldkpQeHRRQmFwMlVBOWZrWmZlX2xocV9iUnctNDVrRHJXeGxoeUQwS3BxVC00a3ZsWXpqQzJvVTBkUEVTWVZHV2hCM0ZvaTdqSEgxRkN4SU1wRkQ4NlJ4T0ZQaUhuOS1tb1dCXzRNOXV0ejlvR1EwbFM1UmpINTJUc2lEUGdnQ0ZiRFYzR3JzOW1fSTZEUmFtbXEyM043MjRrZE1pMzNvSnNQZnAtU1ZpLWw5UFYtbGl0dXRPb24tWVBFZy11ZktLbWo4a1Q2UXJKbnNtakg3TlpQVVlweW51MEd4czdpcG1RckdPU2tncXRyMjE5cDRuYnp2S0JYQ3NCODRoeEFvbHNFd01mbF9BTFlFeFlNbk1TWWZzeWpuZVR1WGZSdnRMWmtBVGNPM1VNaXJYVnBjaUNNRHk5d055M2VzTHhMNzdtQWxjZkF2YWpvMThBNk1WMDlpYm5FRDRDRUxYcC1GSFQ3ajUxcG9FS3hsV0hxRHVobzBmTXlMZWVrWG9uY2prano1TUhYd0V1SzdqX3ZwX1VDajR0SGNaTlZfSTRvSDJkTnJKVVhoU0Iwa21vcmxVZ3NEUGxMbkowaHM2NGY3dWdiLU5rb1h0SElCREZ5SUNqMzdFN0tOaWE5MmdEN1UtaXpmc0l2azRBdUJ6SGVDM25TOHlJVHVaQXdMOUIzdS14RnAwNVBYNVhrN1N0VGVlLTdaR1hxZUxaanRJeXeAAwCIAwGQAwCYAxegAwGqA00SEzEzNjIyODc4OTk1Nzk5ODQ2NTEaEzg4MDI3MjMxNjI5NDMwNTE4NTMiCTMwNzk5OTM4MCoNT0FUSDEwMTcwMDAwMDoHMzY1MTU1N8AD4KgByAMA2AO21bcB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjg5LjIzOC4xNDIuMjE1qAQAsgQQCAEQBBiQAyDhASgCMAA4A7gEAMAEAMgEANoEAggB4AQA8ASU5e6SAYgFAZgFAKAF7qfdod-3k6kfwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFvY0H-gUECAAQAJAGAZgGALgGAMEGAAAAAAAA8D_QBuS_AdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgTyBgIIAIAHAYgHAKAHQKoHBzE3OTk2NzK6Bw8IABAAGAAgADAAOKIKQADIB7KQBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHw9ZkiggCEAA.&s=73966e40153798b0262f47af21c5c9686d992884
Protocol
HTTP/1.1
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
08f18aed76e9840c53872eebcf244a689dee2c942d1c299709a23015ef698e05
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Content-Encoding
gzip
X-Creative-ID
307999380
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
593f31f8-5f52-45f5-aedd-fbec1c0144cc
Server
nginx/1.17.9
Vary
Accept-Encoding
Content-Type
application/xml; charset=utf-8
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:26 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
e2b213e1-aa2a-4b94-8754-450663f64c49
Server
nginx/1.17.9
Access-Control-Allow-Origin
https://threatpost.com
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ams1-ib.adnxs.com/ab?ro=1&an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QKLEugLCQAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9iOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SACkRJNgxAAAA4HoU_j8wn5mlCDjnN0CfF0i3AVCU5e6SAVjLj3pgAGjnpakBeLKQBYABAYoBA1VTRJIBAQb0hAiYAQGgAQGoAQGwAQC4AQPAAQXIAQLQAQDYAQDgAQDwAQDYAtNH4ALX9zfqAjxodHRwczovL3RocmVhdHBvc3QuY29tL2lrZWEtZW1haWwtcmVwbHktY2hhaW4tYXR0YWNrLzE3NjYyNS_yAoMNCghJTVBfREFUQRL2DGhCMVRoWmNHLUpRN0lKc1Z2aUs5TkdxanRPTm9hR2Z1T2hOSkhKVHMyaEJXX0lEdmNEN3N6dTNpRUw0cjV5UXdDdHR4Zl9WTC1jNE95b3lNYy1qZGVyZ1ExX2IxZXFJS0JmcURFVk1uYlBmQjFjb0xWRDhLOHlsS1dpaWVsMXlIdmxXdEZNREN1NXlaRlBIaDdPaEZfOE1tNG1Gdk9tQ2R0LUFXdHVYWThGSjZ6YWdIMDI0YVRCeEdsYmhaWTB4S0RPNjB3QURsUlBQU2V2c3I0QlZHakx0eldpZC1HamhTRzJwYXNCallvQVpWUm42VG5IbkgxZ3JRbHlBc3RWdnltbFNKbktEWjgxU1ZGQ2paRG5jdV9lWk90Tmcta1BlWUlXUEdhMTlxczdVYVY0WDJQYXdXaERmSHhDR2s4NWtmT3JuTm5GcW5DSXhZdmE3Y1kwRndLUVg4REFKQ1lBSkM2Z1UxdVN0ZnktenVFQ2ZabHNBR0F2UDJGUW8wazhXVWtJSDExUVFOYVhUSUZSam1RbFhULTlxRzJROFdPVHBVSDZwNkhhQ2QyNFFDUHJJWFBna3B2ZDNROGtTdEVUb21tLUY3ZHplTUU0MWtSeGl0dGtOZExyeVpTYTVjM2JPUmNzeURzSEk3bldoWVlhVHV5YWJ4cVhKUXIxeDRVd0h3cEJoV1RuTzR4QnIxX211MFBfcmxmRVpoZmdZQkRDeFZUVk1TQm5LMWwzTnBYdHNfWWE2LWRqcTF0eTNISERna29xSWJ4RklVbzZDbnMyZ2dwRjFWWnBuMndiV3FfLUZ2X3dabGVzazVmY2pYckMwazBPQWdWNExTRmd2U3luUUMyVFhvaXAteVEyQkVBNzdodF9GdWxvdFRFR1AtSG1mUTQ5S0QwTllwdjlORDBXR2ZJN2kwZ0lWVVdqWnhZTjZWSnRaTFJzaHJpUUJrLVJGLU1KZURrcHV4Y21xbUcyaVRtbnpBQzF4RGxpQ2xScDV3OVpNNldFNDlyS044MzJuTkVicGFiSzM0WERhXzR5Y3hSdlJhTmE4T0prNlJpNU4xX21NajRmZVVCX2dnNmliQ3JVbGpQSmUwdlcyd2xrZHMxLU1ONVhxaExIMGMzUkZyZnZzazZfX2Y1RzdBYnp6YU8tTXhMRUh4M2E0TlNrYzlxVkJvTVhyMXYyZFhiWGVsN01xOFJaZXF0Mno2dmJyT3FLN1VrN1had3QzZmpMN0s1ZjEyUnVYVkhjREZ0Z2dJMVBVUWFTUWhvX01pd0lGdkpLeHFUeFRjRHFVY1RURHpyOUdMYk1WNmtKcG4zWC16aTVORHZQRmxZaXM2OUZpV3lpejVFdUF5VUhmR04yMUx4RG5KbjdfdHZWb18xLW9PejJqUzJHX285MXN5bzRzeWZlcW1HUzFoM1ZGWGFtTHZ4aXcyNG51MTVieUExeF9IRlBhWWoyOGFrWV9rMjVOSGpuLXc3VG1ldkpQeHRRQmFwMlVBOWZrWmZlX2xocV9iUnctNDVrRHJXeGxoeUQwS3BxVC00a3ZsWXpqQzJvVTBkUEVTWVZHV2hCM0ZvaTdqSEgxRkN4SU1wRkQ4NlJ4T0ZQaUhuOS1tb1dCXzRNOXV0ejlvR1EwbFM1UmpINTJUc2lEUGdnQ0ZiRFYzR3JzOW1fSTZEUmFtbXEyM043MjRrZE1pMzNvSnNQZnAtU1ZpLWw5UFYtbGl0dXRPb24tWVBFZy11ZktLbWo4a1Q2UXJKbnNtakg3TlpQVVlweW51MEd4czdpcG1RckdPU2tncXRyMjE5cDRuYnp2S0JYQ3NCODRoeEFvbHNFd01mbF9BTFlFeFlNbk1TWWZzeWpuZVR1WGZSdnRMWmtBVGNPM1VNaXJYVnBjaUNNRHk5d055M2VzTHhMNzdtQWxjZkF2YWpvMThBNk1WMDlpYm5FRDRDRUxYcC1GSFQ3ajUxcG9FS3hsV0hxRHVobzBmTXlMZWVrWG9uY2prano1TUhYd0V1SzdqX3ZwX1VDajR0SGNaTlZfSTRvSDJkTnJKVVhoU0Iwa21vcmxVZ3NEUGxMbkowaHM2NGY3dWdiLU5rb1h0SElCREZ5SUNqMzdFN0tOaWE5MmdEN1UtaXpmc0l2azRBdUJ6SGVDM25TOHlJVHVaQXdMOUIzdS14RnAwNVBYNVhrN1N0VGVlLTdaR1hxZUxaanRJeXeAAwCIAwGQAwCYAxegAwGqA00SEzEzNjIyODc4OTk1Nzk5ODQ2NTEaEzg4MDI3MjMxNjI5NDMwNTE4NTMiCTMwNzk5OTM4MCoNT0FUSDEwMTcwMDAwMDoHMzY1MTU1N8AD4KgByAMA2AO21bcB4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjg5LjIzOC4xNDIuMjE1qAQAsgQQCAEQBBiQAyDhASgCMAA4A7gEAMAEAMgEANoEAggB4AQA8ASU5e6SAYgFAZgFAKAF7qfdod-3k6kfwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFvY0H-gUECAAQAJAGAZgGALgGAMEGAAAAAAAA8D_QBuS_AdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgTyBgIIAIAHAYgHAKAHQKoHBzE3OTk2NzK6Bw8IABAAGAAgADAAOKIKQADIB7KQBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHw9ZkiggCEAA.&s=73966e40153798b0262f47af21c5c9686d992884
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame E344 		156 B
143 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F107430338%2FCNXORTEST%2F8566&description_url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tfcd=0&npa=1&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=4377219018940847&cust_params=domains%3Dthreatpost.com&ad_type=video&us_privacy=1---&sdkv=h.3.489.0&osd=2&frm=1&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=3321539204&sdk_apis=2%2C8&sid=AA4F364F-7F82-4C07-9A2F-9AABB990E501&nel=1&eid=44737473%2C44747319%2C44750821%2C44754345&top=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&loc=about%3Ablank&dlt=1638263303392&idt=2416&dt=1638263306018&cookie_enabled=1&scor=602352732871467&ged=ve4_td3_tt0_pd3_la3000_er1007.1246.1166.1552_vi0.0.1200.1600_vp100_eb24171
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://imasdk.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
113
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/xml; charset=UTF-8
access-control-allow-origin
https://imasdk.googleapis.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6467
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Tue, 30 Nov 2021 09:08:26 GMT
anwrapper-1.999.0.js
acdn.adnxs-simple.com/vx/static/w/ Frame E7CB 		152 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs-simple.com/vx/static/w/anwrapper-1.999.0.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.13.10 /
Resource Hash
90fb7f486363baac11225c229b7c82176fc1cb6549cae16dcb3e6e41a29857de

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:26 GMT
Content-Encoding
gzip
Age
17365746
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
43880
X-Served-By
cache-lga21925-LGA, cache-lcy19256-LCY
Access-Control-Allow-Origin
*
Last-Modified
Mon, 19 Apr 2021 14:16:07 GMT
Server
nginx/1.13.10
X-Timer
S1638263307.780619,VS0,VE0
ETag
W/"607d90a7-26103"
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 varnish, 1.1 varnish
Expires
Fri, 13 May 2022 09:19:19 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
87, 436838
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 357D 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5029
date
Tue, 30 Nov 2021 07:47:50 GMT
expires
Wed, 30 Nov 2022 07:47:50 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
4836
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 98D5 		783 B
536 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
ca6937e42685b5d900a56805d80cbffbafdc9afe8005406697778f3ec1ce7be0
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-jpC/EeSc3CYHZJEL2Mj7QQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Tue, 30 Nov 2021 09:08:26 GMT
date
Tue, 30 Nov 2021 09:08:26 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-jpC/EeSc3CYHZJEL2Mj7QQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
514
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
integrator.js
adservice.google.com/adsid/ Frame 42CC 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
sodar
pagead2.googlesyndication.com/pagead/ Frame 98D5 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021111601&jk=1960138878124635&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
pack
rb.adnxs-simple.com/ Frame E7CB 		0
271 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://rb.adnxs-simple.com/pack?log=log_rb_vpaid_wrapper_signals&format=json
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/vx/static/w/anwrapper-1.999.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
37.252.167.215 Southall, United Kingdom, ASN29990 (ASN-APPNEX, US),
Reverse DNS
58.ratbait.prod.ams1.adnexus.net
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:26 GMT
access-control-allow-credentials
true
server
nginx/1.18.0
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
access-control-allow-methods
POST, OPTIONS, GET
3.987567
pr.ybp.yahoo.com/ab/secure/true/crid/GtS8pvAF4I249gRs630Vm4CLgxOU16IP/imp/hB1ThZcG-JQ7IJsVviK9NGqjtONoaGfuOhNJHJTs2hBW_IDvcD7szu3iEL4r5yQwCttxf_VL-c4OyoyMc-jdergQ1_b1eqIKBfqDEVMnbPfB1coLVD8K8ylKWii... 		28 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pr.ybp.yahoo.com/ab/secure/true/crid/GtS8pvAF4I249gRs630Vm4CLgxOU16IP/imp/hB1ThZcG-JQ7IJsVviK9NGqjtONoaGfuOhNJHJTs2hBW_IDvcD7szu3iEL4r5yQwCttxf_VL-c4OyoyMc-jdergQ1_b1eqIKBfqDEVMnbPfB1coLVD8K8ylKWiiel1yHvlWtFMDCu5yZFPHh7OhF_8Mm4mFvOmCdt-AWtuXY8FJ6zagH024aTBxGlbhZY0xKDO60wADlRPPSevsr4BVGjLtzWid-GjhSG2pasBjYoAZVRn6TnHnH1grQlyAstVvymlSJnKDZ81SVFCjZDncu_eZOtNg-kPeYIWPGa19qs7UaV4X2PawWhDfHxCGk85kfOrnNnFqnCIxYva7cY0FwKQX8DAJCYAJC6gU1uStfy-zuECfZlsAGAvP2FQo0k8WUkIH11QQNaXTIFRjmQlXT-9qG2Q8WOTpUH6p6HaCd24QCPrIXPgkpvd3Q8kStETomm-F7dzeME41kRxittkNdLryZSa5c3bORcsyDsHI7nWhYYaTuyabxqXJQr1x4UwHwpBhWTnO4xBr1_mu0P_rlfEZhfgYBDCxVTVMSBnK1l3NpXts_Ya6-djq1ty3HHDgkoqIbxFIUo6Cns2ggpF1VZpn2wbWq_-Fv_wZlesk5fcjXrC0k0OAgV4LSFgvSynQC2TXoip-yQ2BEA77ht_FulotTEGP-HmfQ49KD0NYpv9ND0WGfI7i0gIVUWjZxYN6VJtZLRshriQBk-RF-MJeDkpuxcmqmG2iTmnzAC1xDliClRp5w9ZM6WE49rKN832nNEbpabK34XDa_4ycxRvRaNa8OJk6Ri5N1_mMj4feUB_gg6ibCrUljPJe0vW2wlkds1-MN5XqhLH0c3RFrfvsk6__f5G7AbzzaO-MxLEHx3a4NSkc9qVBoMXr1v2dXbXel7Mq8RZeqt2z6vbrOqK7Uk7XZwt3fjL7K5f12RuXVHcDFtggI1PUQaSQho_MiwIFvJKxqTxTcDqUcTTDzr9GLbMV6kJpn3X-zi5NDvPFlYis69FiWyiz5EuAyUHfGN21LxDnJn7_tvVo_1-oOz2jS2G_o91syo4syfeqmGS1h3VFXamLvxiw24nu15byA1x_HFPaYj28akY_k25NHjn-w7TmevJPxtQBap2UA9fkZfe_lhq_bRw-45kDrWxlhyD0KpqT-4kvlYzjC2oU0dPESYVGWhB3Foi7jHH1FCxIMpFD86RxOFPiHn9-moWB_4M9utz9oGQ0lS5RjH52TsiDPggCFbDV3Grs9m_I6DRammq23N724kdMi33oJsPfp-SVi-l9PV-litutOon-YPEg-ufKKmj8kT6QrJnsmjH7NZPUYpynu0Gxs7ipmQrGOSkgqtr219p4nbzvKBXCsB84hxAolsEwMfl_ALYExYMnMSYfsyjneTuXfRvtLZkATcO3UMirXVpciCMDy9wNy3esLxL77mAlcfAvajo18A6MV09ibnED4CELXp-FHT7j51poEKxlWHqDuho0fMyLeekXoncjkjz5MHXwEuK7j_vp_UCj4tHcZNV_I4oH2dNrJUXhSB0kmorlUgsDPlLnJ0hs64f7ugb-NkoXtHIBDFyICj37E7KNia92gD7U-izfsIvk4AuBzHeC3nS8yITuZAwL9B3u-xFp05PX5Xk7StTee-7ZGXqeLZjtIyw/wp/3.987567
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/vx/static/w/anwrapper-1.999.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
dd3b59893dd570ebb6432de87451873d9e32e1af2e8795296d0b163f16cdb980
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:26 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
cache-control
no-store, no-cache, must-revalidate, private, max-age=0
age
2
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
content-type
text/xml
access-control-allow-origin
https://threatpost.com
x-xss-protection
1; mode=block
expiry
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-credentials
true
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-content-type-options
nosniff
async_usersync.html
acdn.adnxs.com/dmp/ Frame 627E 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/vx/static/w/anwrapper-1.999.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Sun, 28 Nov 2021 05:36:04 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Tue, 30 Nov 2021 09:08:26 GMT
Age
12738
X-Served-By
cache-lga21972-LGA, cache-lcy19253-LCY
X-Cache
HIT, HIT
X-Cache-Hits
4, 89343
X-Timer
S1638263307.957761,VS0,VE0
Vary
Accept-Encoding
ads
pubads.g.doubleclick.net/gampad/ Frame 8D1A 		156 B
750 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pubads.g.doubleclick.net/gampad/ads?iu=%2F107430338%2FCNXORTEST%2F6148&description_url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=688377285583206&cust_params=domains%3Dthreatpost.com&ad_type=video&sdkv=h.3.489.0&osd=2&frm=1&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&us_privacy=1---&sdki=44d&adk=1232260695&sdk_apis=2%2C8&sid=D9AFBEC9-4F2A-46D7-AE41-D9CD2E473317&nel=1&eid=31061774&top=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&loc=about%3Ablank&dlt=1638263303392&idt=2462&dt=1638263306339&cookie_enabled=1&scor=1563408480004350&ged=ve4_td3_tt0_pd3_la3000_er1007.1246.1166.1552_vi0.0.1200.1600_vp100_eb24171
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://imasdk.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:27 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
113
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/xml; charset=UTF-8
access-control-allow-origin
https://imasdk.googleapis.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
pagead2.googlesyndication.com/bg/ Frame 357D 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 21:45:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
40996
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13508
x-xss-protection
0
last-modified
Mon, 08 Nov 2021 11:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 29 Nov 2022 21:45:10 GMT
container.html
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B8A1 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Tue, 30 Nov 2021 09:08:26 GMT
expires
Wed, 30 Nov 2022 09:08:26 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
container.html
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4115 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Tue, 30 Nov 2021 09:08:26 GMT
expires
Wed, 30 Nov 2022 09:08:26 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
vista.js
s.yimg.com/ff/ Frame 1A0D 		134 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/ff/vista.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/vx/static/w/anwrapper-1.999.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
cf2879005763af69dc673fcb56a866d2a1ec6a638a6deaad1f91e1336086e91e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

ats-carp-promotion
1
date
Tue, 30 Nov 2021 09:03:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
273
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
content-length
40099
x-amz-id-2
MF3L86MgGtQ2Khx2RNSS1ueOuXzGavXEvGVxu1r9Oe4snNbvTH8K3iQbVhSjuOij3i/Mcm57rjk=
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Mar 2021 15:52:40 GMT
server
ATS
etag
"75b707cea0a2dea94a7dfd21c809d161-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-request-id
538KZMBGWPJCZ4EE
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public,max-age=600,stale-while-revalidate=7200
x-amz-version-id
null
accept-ranges
bytes
content-type
application/javascript
container.html
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2AD8 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Tue, 30 Nov 2021 09:08:26 GMT
expires
Wed, 30 Nov 2022 09:08:26 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
container.html
3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 46DF 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Tue, 30 Nov 2021 09:08:26 GMT
expires
Wed, 30 Nov 2022 09:08:26 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
async_usersync
ib.adnxs.com/ Frame 627E 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:27 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
6e9709cf-471b-475f-a9b8-99462dab74da
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bl-f821a95-b3283f4c.js
tagan.adlightning.com/math-aids-threatpost/ Frame B8A1 		49 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-f821a95-b3283f4c.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b4c7705e3fb3524673ae02c21a55242d92724c6b62e3f3a0ad42fd124cb06dab

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 19:12:44 GMT
content-encoding
gzip
age
309344
x-cache
Hit from cloudfront
content-length
20713
x-amz-meta-git_commit
f821a95
last-modified
Fri, 26 Nov 2021 19:03:51 GMT
server
AmazonS3
etag
"1d3cdc6322495f3eb58e525ad20d3561"
x-amz-version-id
n4Umr6WNCKD5ZemA4L2n9bosJvq2VKm5
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
QkFBo0S0vpNFArSwpEt2sWdRn_xSEvPs3TDOHkQTXe6Za4NcUOZmYg==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame B8A1 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 17:51:16 GMT
content-encoding
gzip
age
9127032
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
MY1bPfgeEDUdYn3PHXvsYpWqRy4HAmOdHRjcLJB8h_Xw0FJN9ooQkQ==
gen_204
pagead2.googlesyndication.com/pagead/ Frame B8A1 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A4T879x67-5JuJE4U-sVrD4jjz_j9ljqzZ8h5hMycJnj_-79w1CucoFTXZvZl1OskON3_3QQQHRm3EvwLaFju30bRSVpZe5pPOHZJtPZMaOIqXEZI
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame B8A1 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:24:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2631
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:24:37 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame B8A1 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37119
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1636547677202025"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 30 Nov 2021 09:08:27 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame B8A1 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:48:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1182
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6415
x-xss-protection
0
server
cafe
etag
16810888504096353422
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:48:45 GMT
l
www.google.com/ads/measurement/ Frame B8A1 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSjtI0lAX-30FH2t3wnPN0mOWkbQpyB3Pqy-qusSEnqg7rjgvVJp75HjrAaS0wZCgChKRJKWExHDgpqRdIkXBNBiYxxig
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
bl-f821a95-b3283f4c.js
tagan.adlightning.com/math-aids-threatpost/ Frame 4115 		49 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-f821a95-b3283f4c.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b4c7705e3fb3524673ae02c21a55242d92724c6b62e3f3a0ad42fd124cb06dab

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 19:12:44 GMT
content-encoding
gzip
age
309344
x-cache
Hit from cloudfront
content-length
20713
x-amz-meta-git_commit
f821a95
last-modified
Fri, 26 Nov 2021 19:03:51 GMT
server
AmazonS3
etag
"1d3cdc6322495f3eb58e525ad20d3561"
x-amz-version-id
n4Umr6WNCKD5ZemA4L2n9bosJvq2VKm5
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
zB3xzguenynf_SwqyPpzo9mt7PlSPyMWV5FSHaAiV9ePrc0BWP5_zA==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 4115 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 17:51:16 GMT
content-encoding
gzip
age
9127032
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
Pv-rup1hyNoMPUmXt_hTHCgAQXpNXIVjcwkmFE_z7HGgXs0PL8M3hA==
gen_204
pagead2.googlesyndication.com/pagead/ Frame 4115 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CXlBjw_TZPX0n_39Kf8r9rlVCR_lNICH7DHuF9ct-zrshmHOu-r5S6WBiDvpoq3mpONUoq3lIpbnj4H8zttarBkJDXZ2EX-kKNqLX3NghOdhqdufI
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4115 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:24:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2632
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:24:37 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 4115 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37119
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1636547677202025"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 30 Nov 2021 09:08:27 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4115 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:48:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1183
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6415
x-xss-protection
0
server
cafe
etag
16810888504096353422
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:48:45 GMT
l
www.google.com/ads/measurement/ Frame 4115 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSHCTQ6IXHfZPAHZKAdqdd8Edc2MqYflNaV9PwSzB1fl4rSxasHj-7YWz4U7BYKWDiaDGgnc5xRkid3W71THXWJ72EKkQ
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
xml;dc_sdk_apis=[APIFRAMEWORKS];dc_omid_p=[OMIDPARTNER];gdpr=0;gdpr_consent=;ltd=
ad.doubleclick.net/ddm/pfadx/N718661.3733522VERIZONUK/B25808693.303738762;sz=0x0;ord=6146034211065294798;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dcmt=text/ Frame 1A0D 		41 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/pfadx/N718661.3733522VERIZONUK/B25808693.303738762;sz=0x0;ord=6146034211065294798;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dcmt=text/xml;dc_sdk_apis=[APIFRAMEWORKS];dc_omid_p=[OMIDPARTNER];gdpr=0;gdpr_consent=;ltd=
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/ff/vista.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s22-in-f6.1e100.net
Software
cafe /
Resource Hash
d00c8b7e3ca5dff45a99c35859fa47ac7f74ce88c3ededc0e65664836109a21e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:27 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13323
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/xml; charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
JS-60000,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3E... Frame 1A0D 		0
47 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA/JS-60000,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:27 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
bl-f821a95-b3283f4c.js
tagan.adlightning.com/math-aids-threatpost/ Frame 2AD8 		49 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-f821a95-b3283f4c.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b4c7705e3fb3524673ae02c21a55242d92724c6b62e3f3a0ad42fd124cb06dab

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 19:12:44 GMT
content-encoding
gzip
age
309344
x-cache
Hit from cloudfront
content-length
20713
x-amz-meta-git_commit
f821a95
last-modified
Fri, 26 Nov 2021 19:03:51 GMT
server
AmazonS3
etag
"1d3cdc6322495f3eb58e525ad20d3561"
x-amz-version-id
n4Umr6WNCKD5ZemA4L2n9bosJvq2VKm5
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
zIthc-1JGWNtpQYDG90sc0Gp_AhT17-QX5jCpIWY2Lr_qD0wrtajFA==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 2AD8 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 17:51:16 GMT
content-encoding
gzip
age
9127032
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
X5LcEGCglWMm7dPRv7K5e-IOUjc-jvTFXmGvq1q7uFnv3iDwG-I0TA==
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2AD8 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DDr_nMZ4EizC5R24ryRAV5ZVyKzpkxE4WlIPZwgR3VKI4Ihm1uHOuPAXcDffBzYA6B1uG1JE5FPeA5EU_Qpfe4j7-24GxCiUpYj8uVHjPTN9tTBrc
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adj
bid.g.doubleclick.net/xbbe/creative/ Frame 2AD8 		56 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXaHmqpe453b8p7aKEZ0_vQUYpnBfYbx75UWgDGmUiC3HdZFxU&d=CnkAoCZ_4AGNDZbVSK1NuCx3mX9XdkBsoPSuyua5ojZQBA_QqQSmEKShkPX-xH7s85QPcugHspw7z-x4YixVg6TboL5aWi57qmTieGzjXaH60AsTPq399g3AeX1--gSCL7e4E3inLVT2_ShK1CfavNdNkyrbHoio6DIMEokTAKAmf-DT4vxH359JVMGpm0isMZ2TFlru-PpTfy7F-MHV3ZoDo2EMK1TbRJ63a52jwIRCaMk2nYrNkUiOCUiqtHKqSAfZwLRt0-fZxq__yV6aI70UtbH0zZA0VEBewXZbZ9skvVgHlayXZn-X6_akBEA4BFmSWSZMI3qwDtBAKKcKCeXy_HqlHBY7nv-VK2qdkjbwzVOBh-SlLKK1T7DrUme-4s9WVOxbON_dEQo4_zSvmdqSk8W_2DsIcNPtI8zcuBZnTnw7vGQb186IRoCREJeFZD-BfNr2iB_eoRigBL4bcextppnY8oP4c0WOrw6o2vj9pRybRlIGF1K8-DVV4ysGiHCyYz3z78mmRKCxnAEp2rRzhBuLKmatW4rKb_6aJX5WusdxRAxO9geEZ-IDzaSiAbN663TscFBFbjmyDGirkx2lz-N1PDbI_AH8e-BLyF3We-g491ttWo-U3rRhiiLNIRiy9VRjhP9IHkSF0_3k3mPGWuZnsXpPb0Ka25mvvvHfwG-paSVPcGdAAXKzK5IQlxb9o24YrcPkHfljXeHMJ5oVIjdHEcu7RIVeTd7UtYk7wQhqA6D6OOto3QDC2bKoFFzYqoMachpKcbnq-KNvVnb-8yVGiJa9COBfX7DUcm2bhqCXV4YzYt7v_7FQp9DWuQsXmj1rhxtwj9_lj3jLKcidehwa2PVvcPHjngJJEg-788oUyzuPWWStI5diwGBnUOy5qOjeNxNz-7S8RGDIttiRLwwaA4oSkIiViIN4hH-RWdqjbWnwheEoIJIg9B_02vhfVZSMfyHifL07R0XjfQnf8H116iVrKN9y2DW5-p5Z4yxVrjt_epfu6lFfLiIRdzniCEXZ0gsBPzIgozDOGZBUWWkWQRpDVyHZI7dNtyWzFHeUMYY8OOlNdn0o8CThVGW21nZ7DEjdazJrRtdhG4HoTAxov4GgjkelQMr1qc6eE4DvIRiLyF5PbUH9g0zesUmxDr7ib0fNOrYSZ_vjiFmCO4G1oUmLZq1I7GOFOkXe9SFI1uXzeExzqfu6D-xtKvdn7-ftG__AMqJ8vnOrf1Zgk2ZyS5ONhpv3G6ftSC-LNtPTsn6YbZYbBryFStz1MRwhUZnyjwYueiwIUiTCpn4n3LGVG05zqxdSqrrbAqBlrgu5O1otIW3VX-3xmt8qDQG2R9C8bz_uC5gf-aJwfR2a4D1dQffJpYtQW_mtvGMeoUrjLPTcOjNlPy6ZQNsaMO-aJOsNRk1z9fXM7pGV5845SU2dlOyWCchJus4p1_KPR_Enm0rzdAOVsT0QE26WH41wwJXbfbM41DqGwkm3L1YtrunPCUx2HvHJqabt8eT6_JV0W7iJNBKgZuOFdoz97p8a2g_QVhra7xaMujl0dsFqXFHCLbZTVSsIJg6PRfvu-UYfK6VpF0-RUviBF2QezsZIHSOOL5OrVir6lFSBFpAnx1tfy8KXck9FIFEV-korknWBJsw8rnplHigrrFMOAjKVxHlfKygMvppI5RV0-7IVRCrvns0_8WCKnZ5IuPw0s1T37KGVCcG9LFKg4g9Sug_qCc4jRP9mwRx199lq7ybWw52CgHE3bPjpBN5JyEJRrp8PC3CYF8_5dC53JY0hypDgAgZGkSV70vepjNa0dE_KX-lsvRTKQVT3-1KuLwK7MsinyajsE9YOfXUlRYvhhVfQUxF9RJlWmxNhcIlJ6kqadjoEm1vqoSqnJYqRiBUgxqg0mN84hSIS1c0gXQFplj136yrOITEC897u6Wsx7ZDcfIGDTBbmM0quwTSlE6YtXTGcTn2xRUd2HUywbEsOYIpz9-lenZuA9DuR3U2hnTwEY6m_HEeJ8RMUxynihZvWyW6fZZSmwk3AhhGHo8EswZrUgjFJ_MYkNBUb9IENgihhA6pxHoeXa3NEOWkdbu7VRyYTriw7cD9CMGZTXLaKvjE9BC23Encrn1276noVNWrxzjJNbOslEfjL9GgkpxijUEpbK92Mf1maJdC-cKTjXHvFH9bBDvSGON8jOq-89Kf3pfpjEzVNSIURIBj8YvDH-guHVi-8Y67Hw3F9_9NOwxd15_JY-KyyhbziriWE0Q3Sf7rMSAbKFy4c9v-QzKcfATOlZHyKM83eTZzWOf7SFGLpHtDxyzXV4Os_lVeenUUW9JO6D0zIzOprTPfZH4KwyJ1g_0l-ipVMEKO-THeZS18St-uyt08iS1sv45WtxIm6bmvJdcJtS_wZRRftTpdqE-u_2W179laOQxPhMFdNIzMO4OE8gj8Zg6yEfiYcOXmAdBuLw9ZnhOL_GYO57lX__fMwTCzuoWW2ExdwY6WiQQ_ebSsutZi74aDHS7cjKzWDrW4nDWDjRanGX32gR93FHkphrSIKeOtXsNFyJ1_qxp6_7dEulOzyJ4oWeKPSqpAPfKj2hQubpYXki6BLXrmlGB2QAdX7Pmcla0KwSkXjUpLUFw1fb1aW_UoTWLKytn_AhoV5xSF4VJwgbgH2_UK9s6DBGe3vNYJgLO89W2fOZj0UQQmzyK7SkaRlqxulVVWN-fir1K1gkXDFh3fEVMEAmkNPS82Md7TC_mwgFLgdM2NR0N9UMw0eddSHeXIijJwr4xayGPzdyGJiTZRKpAMPAKwvoAXOBMwa-bn2zyrcHYEB-HHW6dGBcCU5xz1NElU0lfShmG4haAWLUbuceV8UlJtSCKro3AVPGpqaT9AyU7xiTk8aDiTcOFdjQWbZdggjjV42B9jYvNJNjguGh06D-olk44OblwjMv10-vaXzBe3VLq27gcTWtlUKCQ4t-U-9ZoqlP7g6UzcWT5LwCux75cbq5b_m6QkTi2Ys_X5eu2-PIaAvssx6s3Lt6JUb2Vr3rA_ZtiMvHOitBuFtMvj9QbSrfQjM_rlu_SdxPzd8jptYmlFTxlZ72IAUCIozgOdA24OlMF8LDEGFaZVnH0g7zUgJFEMePkMDCkAkKlpyFqCcRZElp6Dbs9zWe1lOKPt9om0fcSkN6RZgprInKhq0ez-q1T51PyWpoljSwH5KWZ2M_MobP0q8BWQ7HGDF7Yao24wg1BrBefNeq4vsiUhExn9FS3q3szg5DsnHNWPpySKg2O4iOZe1_v76nraomsRkv6Q2eQNtaBsFZ6A7Q5EJlkohu7neqRRH5w0wp_0HorhTJ6-jBOJDx-UvKJPxxRqGxs_JGbnh3UCQ8xeynbCRyVewu8Y4jipY71UbB62L_pBVzYoi8Uov9rjeivT_yqK1ZSizV_4aGQgAEhXkaFBOu55emBaWyLM29A7fLX3FqLJgAQ
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.184.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wa-in-f154.1e100.net
Software
cafe /
Resource Hash
4862630c71a859f6e89b81c4f4565940de1c321bbbb21c697c25924b304e09f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:28 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20319
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ca
choices.truste.com/ Frame 2AD8 		27 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont5&w=300&h=600
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-128.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
5bec6f9dee779aa19f2b1dccf9e55296725d796fb39b3a4f0405e62cec1518ae

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 08:40:42 GMT
content-encoding
gzip
server
nginx
age
1666
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
6BMvA67tCSl8zOcgBNH6-0IZpWX7FHXc211kpkAXPDKomQLg6Nxu3Q==
expires
Mon, 26 Jul 1997 05:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 2AD8 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:24:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2632
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:24:37 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 2AD8 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37119
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1636547677202025"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 30 Nov 2021 09:08:29 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 2AD8 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:48:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1184
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6415
x-xss-protection
0
server
cafe
etag
16810888504096353422
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:48:45 GMT
l
www.google.com/ads/measurement/ Frame 2AD8 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaREToTjz95a6djOd42Bd-qYiiXKqJLgXwvpL5ObVIgJK_Ys_FiHurg0N37H5Zbwkj1Bs8BLdb58GKIiqMUXc6cbE5Bn-A
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
bl-f821a95-b3283f4c.js
tagan.adlightning.com/math-aids-threatpost/ Frame 46DF 		49 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-f821a95-b3283f4c.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b4c7705e3fb3524673ae02c21a55242d92724c6b62e3f3a0ad42fd124cb06dab

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 19:12:44 GMT
content-encoding
gzip
age
309344
x-cache
Hit from cloudfront
content-length
20713
x-amz-meta-git_commit
f821a95
last-modified
Fri, 26 Nov 2021 19:03:51 GMT
server
AmazonS3
etag
"1d3cdc6322495f3eb58e525ad20d3561"
x-amz-version-id
n4Umr6WNCKD5ZemA4L2n9bosJvq2VKm5
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
AEEG4tZL6fP9mdBQmSVEWrByGrV8nxAwtFuuMJ8hmNJxkXWqkYBD6A==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 46DF 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.77.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-77-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 16 Aug 2021 17:51:16 GMT
content-encoding
gzip
age
9127032
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
gIMluelQj8qmA61rK6ZARWiAWyXmwz6UtQNks-I-ltYNUlU7Me4Gww==
css2
fonts.googleapis.com/ Frame 46DF 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 30 Nov 2021 07:51:34 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 30 Nov 2021 09:08:27 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 30 Nov 2021 09:08:27 GMT
feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 46DF 		205 B
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 14:17:44 GMT
x-content-type-options
nosniff
age
67844
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 29 Nov 2022 14:17:44 GMT
settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 46DF 		604 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 10:23:17 GMT
x-content-type-options
nosniff
age
81912
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
604
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 29 Nov 2022 10:23:17 GMT
interstitial_ad_frame_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 46DF 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/interstitial_ad_frame_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
db8deb30d5cecf873a6361b5410aed53a439e46072dcd6af4dc2481e44ea2a59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:18:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3024
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8141
x-xss-protection
0
server
cafe
etag
15959965552278146708
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:18:04 GMT
sv
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/sv?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:27 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
pixel
googleads.g.doubleclick.net/xbbe/ Frame 7B84 		645 B
742 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY2pakvAEwAQ&v=APEucNUVygIjliIkBwdyFJgFaGqPmjom6tJTRcnXT7GkD8yBdmU5jtsbd0Gktuv9ZjewpMMNl7lC_E-BtM-JLx0f9uuC96GKXjgKoS0XeOP70BI71pb1vX4
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Nov 2021 09:08:28 GMT
server
cafe
cache-control
private
content-length
285
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame B8A1 		54 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D6hQ-C98Pn8uABdSMwjfWeJPJWq8zClYg0pbhCbyb1qU9oMiK6Plhmbi3lyFRFvbvLe8R33TqjThwuvY8SYqtf9t8-GVJyy5JJKrls8__y4G601EzKKmoNxfnpIu4cpAb6tAjdrb4DW0CmLCXH9Cb_FW-3Hg&dbm_d=AKAmf-CT60WQClozNQuwVziJSe2HQ_ysjy_CKc0j9kQzBjRAjJM7rjuvYLlaInpg2MT6mEdLv-Mr0B82CSoqZTAbmkaHlJOqUamdxa38nxFUCv40xAn4JD2_AhjpBAJOPnD_Uj7UoRG5YT5z7La4zg7jRhBnEk7Gu9_px77GZabGN9dYp_BswMjbgrgs14EiUuVV6zcPfKbK2KXfk32rtDMh_qmE-xvUUWs2gCOj66Qn5d21oAXfUsWq2b4Ck2JJ7hsu_vuSXjwGR_qgdQ0-aLysBlWE3-cRU7XM6aeKC_WqP-s0Do68rlilWT7Es-w3PyJpNUK8_HuKKYj75V-B8kwX3BYaPiu5hBwbsIA4AUcPr2HgGhyxnYA7swo1Cv7TCenAj1GJiEr4bhzePS0JfitW7z20IvSKz-GpjOytLeZH5v_uoG6E42qnherpg0OoSgHVffp148JiBrXtv-QcHYmJYZ94UKqaS7oVebU1FEp10QWPJuUUCku7eTJTn1fuCijvXGzS22zaY0G393dEgLe4yJVKrhVqpfjMyRUZyQq-gOA4nKHzZf_-O08x3He0cRm42E0DDld44IJzy44TMrb4SAvcM5CLeVX8vma6vUSi40qTnU5TUmS2-HQZ2BDvb7T3OhpB6RkJbuySueozIv49Blzvr_D091SyUwxTRP_pDC0rnIXhDYiRJs7dnf35KZ4SbjDGXtfkan_nmugnTSrzE5HnagYXFoIgIsWGEIiKTtShT8eU3Wblft0TkVNuaPQ47j3hPFlITXVL2U0rNoWJdi6gpG004NTQyE8SVvkX48tIyujK-zhdGF7eX8j2JBycLUMgPDMPs2aOg24UTC7Wo3SHwryRPLOQYw73FqMPCzHKUi8r4kQYLGLbA8iOAsQniCDGtpqAD28YAFhwn_qpzKDKyvIXWC0kARzJEXbdto6w15IJdNUAqA42KLkZQviN_P6Zphqv8_yAueEWiS-qgJjXGKp0BuEl-A4Y11uDL9uM6iXRziUfYjvNyzlbRvY7d_U8UO5qdPb9bIgI8aYwWRtchVhRUV35k4y1wNGQ0Ha44FXvrhTegxV9_KXv20aVxcg-Ecqbz2Fx-f6sTYzRSGS5aGT8vcss9hI6n2DyzR1abZU7VXyTNtil7DYbxkkA7m2gVsFNIVK38b6SoRG2AWtvwQhd1-vUgyATeQ_UWfXHWHzyoEaw7knF5EJR2xQa1U0gIxYKs8vxpWcUY65Y86PJmKMukfWK6GbVLllEt5IgTReompEBQr1boysZAdcOEYqaRp36A4U-QJ41ZglOHjD1F7lZU09Gt6JICX-35SR6PmDZKr7bR3JK7Jgmz-BlwgBs6ywCgy54lPzjyw5rdktoUxeioIezM0wBvP2vfwt4QOA1jFkJGZXXunLTLDnc9f4SKE2vy1UvbElLovABNPL6uqqsJ5DQ-Z6lpAuQx-iIqD2Gyl1fpRZ__ZJ6OyFivk5uWnErwrtJ06cxbC0pkPZxhzgI4Sm24yXNiJoy3g8R0naSGSnsciSEegzO79CR4Uc4dN5l11o8jLNSfPdqDghuqgtkFZnJJgh7GAJY1omP39TbIB6i8tgIj4_ddfDdnKrNAAaLLroV5jdAbKp2O9bpCEH7M5W03cKx3TVePI4jOv4Q-93KNKOVCtLtyuP9Rk2u6Be2H8zukxpN6iYTQPnELjtC_dzMSPIz5ilJbh4jQ1RI99vYw0Xjx6VwVG5dcCros6nvr7YltC_gZ0n2JUxF2tF42DzG93yw8JXVqzZP-zm2ayytRpGAwmda1E_vCOtjSq91XEE5UlDgWxDCWEBySq0N5WLWYVbEJBhh2liZx2DUk1WErMy2wvorPzipUZr1W_AceeJPs36m1OagH1cIjQ__qXMJpOaUIqidepSbuJcLyXfL25kg5IQaZYODMB7krt5lHSP2hNSQ4kJb_3Gn5IzYUatsZuLmK7vrlGqCHYDP3n4mbnz9JzrMwXxt2CUlxjRe49wtTCzl6KQSwkmehp3fc58lJKxb1fEht24qQH9C7yjf196gx61aIlNGVv3AqrFnrkoVG5XhtBPChsL9gDd_iwRuRPwL9ss6Hhm22AAgiBjkbJA6ltXMlz8TEiBj6WLQ2bwXjqe2JjLsb2byApPBNrCCTa3c9dHSs_296bX5ospfOazUQFDKl5ZSF5PLa3MrHSbobJFGob8HWKgW_0K-dp2sCiUTwrRzpf98LPaK4NbYdOKvfvZKgUdGZDGmN8-raxjUdt-AT11XtSAfyUhfLcueTitNq28yg-fZBY9LQHm_9nhRHIpd603nz8w20AesTFIQubTeBjH7AxYyQnYhBFJWFZIQjcozi1aAX6S9HWnGP8KFsGUNui5IT3BOq1X5015Tzie9dzwiEu4D14qiz4YV-_CISUxf_64-ZmlC45GfdmUIyeFhBl14tXafjBPDUwOP0Xo5FBDTEB0kk_aX1yAbrSiPtwVR6Z_OB_xpJiiXLEeXeERWcjPxBRKVssrqRSCkAIHVyq6v6lsNOUh9g9hB8Vq3bf2f_Tr2Opv2BhV6ZW_OeQWl9F08JR5_jQdOJvaWdodiDLnjznIBFzJ77DVYsa-CUcpxds10n19I-wxa4r1KkOcf-mgahuteL3H8hCQ2yW3RcFSyZFzvL1AGvFLLl82kRWsdcee3fNiyGfY7LWp46bYHv7-Wm3VILN5LuvWmZNS8u-QmfPKylG7EF_DRCuqqcTjHO4j-ONWxOuVnu80NWg8NxReBFXWwsUp7a-XZG5XrABnOZW-yC1TmD_m7IcLMFVAJzMN4H9SlP6XTMjnEfRWP_S9jtr6AS4KygApEzhJfYONWuSn8ASwaCj7m4__LZ76mAt0gnafmhe8ErU7TIQRLzNaWrV__UirO_phS8EDa47rFBsnVvLlF4oMncjMROsPsHcK6hqoIlVh3lHpUP1eRt5XxrIrwC5v5dbhXXgHpVgZN367O3Jvs1Yw-E5vgj8HRmNYidoTnKeC7VRkxuQY4uy6Hh9dXD8lsOphhwL9VOmjII4yPfOVrx94D2KAqczmwA9HywVD6pysexwAzHDnCa-7bmy8vhrEi0Uc1rd9RL7bfSfvllhn_YbH7C_TkqwDSdt08g0J5gzfvFg3evj1usvt4Ymj4sT29o02dZ887gjYoEDIna3o33A63PboWEwsvUnrIIHm-cNQ-eMjpIPkjo6VbQbSrViJx&cid=CAASFeRoS7rBtuil-pemNiC-iCblafGFHw&rfl=1%2Chttps%253A%252F%252Fthreatpost.com%252F%240
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ad852ac5870565de6715d223dcfe2eb2d6aacd30ede4a4e1ef356cb3a62346b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:28 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27965
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
moatvideo.js
z.moatads.com/yahoovpaidtwoint215831825037/ Frame E7CB 		341 KB
113 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/yahoovpaidtwoint215831825037/moatvideo.js
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/ff/vista.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
cf4f9c30d0de5ac0f5670d7931f8e77aa743bf4e6a37d82b0bb488ed35b93bb2

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:29 GMT
content-encoding
gzip
last-modified
Tue, 02 Nov 2021 14:50:29 GMT
server
AmazonS3
x-amz-request-id
P9CMTR83C9JW44HY
etag
"6db937f77109348106e9d96969019907"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=9433
accept-ranges
bytes
content-length
114764
x-amz-id-2
JuunRJ07/G4PCJYofLCo2dDyoRdOAO6930SwKVWV8yS21SnoPQZMMMjO0rzvOzpByW1dHqxbtLo=
async_usersync
ib.adnxs.com/ Frame 627E 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:28 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
872b64c6-33e8-4955-b153-d20680cec776
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
file.mp4
r3---sn-aigzrne7.c.2mdn.net/videoplayback/id/f987a42d353e57ff/itag/37/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3765685876/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,m...
Redirect Chain
  • https://gcdn.2mdn.net/videoplayback/id/f987a42d353e57ff/itag/37/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3765685876/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sign...
  • https://r3---sn-aigzrne7.c.2mdn.net/videoplayback/id/f987a42d353e57ff/itag/37/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3765685876/sparams/acao,ctier,expire,hcs,id,ip,ipbit...
12 MB
12 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://r3---sn-aigzrne7.c.2mdn.net/videoplayback/id/f987a42d353e57ff/itag/37/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3765685876/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,rmhost,source/signature/49222DE1BB06B1BB4C0B7021DA2D77F3B8B9D63D.1E2B42F531F0F0AF2FFBD886D002A6CDCBEAB78A/key/cms1/cms_redirect/yes/hcs/ir/mh/BZ/mip/2001:ac8:21:23:2db::1/mm/42/mn/sn-aigzrne7/ms/onc/mt/1638262842/mv/m/mvi/3/pl/48/rmhost/r1---sn-aigzrne7.c.2mdn.net/file/file.mp4
Protocol
HTTP/1.1
Server
2a00:1450:4009::8 London, United Kingdom, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:29 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 17 May 2021 07:51:15 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
video/mp4
Content-Range
bytes 0-12951558/12951559
Cache-Control
private, max-age=86400
Connection
close
Accept-Ranges
bytes
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
12951559
Expires
Tue, 30 Nov 2021 09:08:29 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:29 GMT
x-content-type-options
nosniff
server
ClientMapServer
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
location
https://r3---sn-aigzrne7.c.2mdn.net/videoplayback/id/f987a42d353e57ff/itag/37/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3765685876/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,rmhost,source/signature/49222DE1BB06B1BB4C0B7021DA2D77F3B8B9D63D.1E2B42F531F0F0AF2FFBD886D002A6CDCBEAB78A/key/cms1/cms_redirect/yes/hcs/ir/mh/BZ/mip/2001:ac8:21:23:2db::1/mm/42/mn/sn-aigzrne7/ms/onc/mt/1638262842/mv/m/mvi/3/pl/48/rmhost/r1---sn-aigzrne7.c.2mdn.net/file/file.mp4
cache-control
no-cache, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
705
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 959A 		668 B
325 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY1Y2kvAEwAQ&v=APEucNXKtfKkZpJagbbEl7SbK6_S-awmAfb1eW1UD08aeVVJ-GBEUTZemE_B_22dyJWspvDlKEegBoj0eWVTRx23FbB2lhhm-kh115Y9uih8HN4Rcw7hpYU
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Nov 2021 09:08:29 GMT
server
cafe
cache-control
private
content-length
304
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame 4115 		54 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DApZNhxgs-vWvknw2ZHo8WDJiFhouZ5iKaY8nldkYXQviTayxnb4qFYJ5N7FoxpayMlvOHGFmJ5-7tntfmSQhARZpWruvKOzNgnbSS3_lYxbpKQNOsGtW3hbXl_I95NRCaxK_csf0_me3-KJw3v3pzntHxkg&dbm_d=AKAmf-D1fpy4anRGGyAEZCQFBd-D2r6H5T938AMUBea0z_woofC9hjTp3KuBu97LCCeeCREErStzP92NSlDuzOWSjvCDhzjiYcxmUWsuFzKD7QkAyuN9xIl0Y4Eecn5Uevg3bCVhFFnqDc7NV5hd043tbu_Kvopvm1zGW_7wDPzKkmb-3zb_JMsrWKrLNLMwJvM6oZvP4rk85G4RqxqADWjGsrBtni7qXzCG75Ha7YbiuEbVWbQwClOwWwr9cSaajhsSdlXhkg_61LE8yGkF9tRRoq13hqxHWxpEGCod4jrmIxzfLMsIYd8oLUP6IDxv_vlYH3rE4jW9qCRi44aapJCQHdBMQ5PAEGd40EDKwDCDBXZkae5fD_U3ZT77I0_kZsigo5BpCiNyKTIVVek7jj6B1YVKuf3n6GZCfV6z9Jw_PiG5e5OS9147XHXdqMA26Dsc-Rjr6o9J9T1ai36KiZvE_g0qWiulL31bBEvPtWHg9Ha7HDpAtWMhCAXjUTINVeFFIOiIEc4nm01qNbPCypDlcyUKCEK_bTtsqy9cyYzpNpqJZKzcSeism53fjvgjdRFIngIiAuDrHtdQMFK9P9rSvXQLHbdK7mZq_zlQEf9twXjdBrHHqx1x4uSx2fUDOaDsCuxr2-v56ogtxXopgqgdbC_yi8ffOBdSa5HoXyijKUvjkYVMOVZkhdZYpPklMxy0iOH2NC1vY2p3JPemMPtktYxLxwM4sf4TQl1QCqsVBcIlJDmcqqr4N0pdlvVEa25smDd_eKlw9y7dNd1PiK33INBn3Lti3zvaQUZMKo2DHzDsG9PvocmPWTYZ1Frm9lyiarrTc0x3Uw5PNJm9vlRu93qf_htGAsuxr-TU2VioGutsbIz2AaoiFqZU2lrIvHAGU0bon68u4PMZsXjyvbJesz2oidGtBjKavkD3cRab7UIforMNA3tTnHAjg9GC_37Wn3wByqFvaBENB2nZcMu4Rtz559UBqukHoctKwC9affXWpGonStJAb3cdRR56Y2129mreCk1GyT7k_z-CLJZJJoBtTULQC0RhtTVzYZb_Vj9KytETSsDycjCMtvlE-7aZ0CwzEuqkR5TpDZU3-UhT68MV8DSYLqmqFrItS8KlvUunctrE50OBwTshBa3YHPQ5CWaJdCOAsAG9vjDz39pLaignAYOnz0hW60ixxr1DsJm-71UhgcGOzCYt0AGNZTnjqumx8h9afzUmf2YEQUd4SwEpXvWcQWVsO8w6uXgFnmojaKFFR_Oc3AKahfo4qm1pmtxybD3LEoILW8adUc2UHjCgGPW47jWFOuYoG1OVlJRrh1yxwSNTiJhsrPViwyRzFzGKpHoaWXzxTDg6gs35WBOa_wrt28ldf8sGqVJ2YTOKSs3xLyaVsfYWgXuFz5pDPfdRnNXmZIYY0yyfkon-grPV8cMwQ5u7JgiRUSH5ZDLvldjycbYRYhlQcRR8zPwXRBy4xWOLaoRMQFp7I_CqBpQx_Dw9QSIOV0eBlCsNuL-lE9Y2RPUIfx3mgyWLGky1NQwj0Ze_N88t5v3qOfsUsPsFJweT3G_aCLf-zaJdkPO24_lrYwGsDxndUwxsBlHs97P3ULWN-Im-4M0tN6EBrXvQOLJfpsRG7BDT0L3snwVf6bhYxFxYVuztazRKJjY0pCiTtJyH8wyDvaD9YYqMZsOfnE7p_mdy59qbU_UrwnieUwP_e4xe6ZbkmF8c1r0-j2YOB7YgAIU-KYxqz1NCuSrg82qxlNA6DRsx-GsQxUkA4gLdM-_S3_qQAxIOURLqCWPPwUdUImltHmABDZd3SjS5LMC8JnWhfkOTTYK3gBCWSivNJicGvOPd3zXK1WXGX7ra4pYarrLfdT9ZmVgi3lEB-3bknyPq9t7tMggN3JvYwMm00Vmy5M0FzftbzFUEoqx-9NcRNnxee7HZzKor-q34fOjWQGio6BCWe_38dWsJ4OKBYZtozmaso6IM1zRU9PRAIZwSfsRroGPjDCB7lbBxgCwLaiqGrDb1bSmKANU2I8A5uljpCm9VjgUhRDPXY3p1YhNTEIlyiyYieCRIo6IF9WlA3eoRg_EWZYb7nKV599AAxVMWZ5oIR6ZU6BGpb_chrhH5R2uqi5RdLJZjPLjV6Kz1Xq6Usk_GVD-xkfabpcPQ0_JtOlGEFer4DYAqqLxzglY72l-P6xylls8oqocMAXGIq6B_b0J4-mwWviq_-CTUbmmH_lsKM3OnfgTaWJhufTV2rti82prtR9AFpFYQMCF-SdYC84WULM7wD8hW1joJWhA3LoSyN9EZLWDNdJHKykiTDhzyjCHREnB3TpniYEGf5XyU05GkW5UzXiVzBKlebTTuJGgGoa5PZWiqXgdgjriBTOtcodwn2HISumB49fDxiC1sTJD5LFewGCjDPg1jleVY5b-p3I0NnUSUnl2396DHOxxhq2VVLpmUGaEN336az9BPh6mIzdJzoHiVm7uaEbDbNV5JB1PpksNxGzq6Yhmz8L1EJBOGCdYmiN9cGI-POgm4VMddptv0isfILHcc4C6d8aaB_QeCfZ5FJ3h9nhQ0QngWfr9urG-jlGdFhpYbXDElSRu4UMRV5YudQ_a_ygeqwZC0UDyN9507nFiLASSV6XYZjdc6_u-TLWT0IACbn-b7YnGM5UV8EeHM1UP_qcP7gW0jx9MD4Wt3Km-QetwYkLLPEcTWrw4OlpMlWit7HIaqugrYG1DlXSfznUpj-sFSscOjr-f2GPSRRcDgD2yvvBiQlqPKsc25yZGX5h1BsZUUCrT3sXq9MiyHCesuUWXwbB8CSEfoO58uLS1BYvpiz5qoZ07z9WeRp8BctNbjzNCzjQ8SwNlzWuiV_LXBtxICPbQjicWk1WSHOcpRY25HNAD9cDMc63apOdTlnOSwMQRfuRBtW7oBBGBzb221LyrLVPfelo3QTKDiYEl8h7-VZU0oXZ4V9ZSUiNRGfeogKwUPSA_MsUqskESH7oqSg_cMvEPS1QIc-NSQRBbkiGLihgHm6wCtv9hqFzsK6Bz0ZqspcgUPT4445a6pL_0ZwZvYtHNQ6_u5q9oFVN4XiZH7Q-eiqWTi_vavHjWF3NTR_cFnwwf3znUuNjjJYvcjgR9-NemiL_7z4is_o0QAUhZXtoOH3lQdVv4mj8bqzBa_qslXLP7oC-vpMe5blbiq1R0np34sVypAtEFl9DJ-0hc5P0aoZ9Y3IWcWhWJ1pU9W_g&cid=CAASFeRoZFdozcE_Jb4tqbjlpROFw0nN_w&rfl=1%2Chttps%253A%252F%252Fthreatpost.com%252F%240
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
62f78842f130e9a3671d447bbd60f57049f10429fba72a424d724377a691237f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:29 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27960
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 665D 		668 B
325 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-Ahj8rcu5ATAB&v=APEucNUPKKdaNb2UqW5LdOMpf9CTTewVMlTAPPffIgjnUYK6822T2BfKUVplvDXZRLh7c-GRbr92qaChMo-XclzKrK4DFIUypnFj79g8oTEiy67UrAo-kFQ
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Nov 2021 09:08:29 GMT
server
cafe
cache-control
private
content-length
304
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame 2AD8 		12 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CVVtGjaOATMLUqM2UH7JmyFMhXZ-l9sAyhugWJpr_Fik7aFIPUAHuFdCRZySxCT0dxCPdmQRfSfn8h8HiBL-d_FgIeQKW_0s3FshVqNCANui_xupChf9MxII_wEAkCelZdskTk9bf2AB7upq8MAnRAT-E09g&dbm_d=AKAmf-DmeCilGZRgehMFgtPHZBjujeSEyduSYnrvz1JLiI_RrZU9m2sUN-xEC9OJpeLv_QWQRCfYLymgdiQUNy2tmvFGOQ7TNWW8mDrpmQNbo6ZOXZxZet_W2uCiN6Ff87PvlgH-lqqNIIc6aZ-xkzL7LvvfjDnQXkOAxk9UsZV2PQpdGfzWoitUmwM9GKVinpOBxIcU9dV-d0YawaPvjRPXcXroQ-dnLee7sbX6YqJeo48EaUV_Cbx8adIkGGwkatD9b1UmrWrWVVZqshXT8IE1Yb83HOgbohXbgvXhHcIHUSW7P8bjLJf9dM6UFweXtyet618gJGyS6wZi-C-fwppAi7hR8Fcjey_VUK7vViwC3gsxqxEnI7cE70zGvta5lzBsjOmLG1i7z6Vp3s-vFxLNXMG_3qf_15xKX0CfO4zKzx88T0DVIXYS8AgHK64gNpS-enEcqwOi-GpEQt5wgJBW9575o7pnZTwnphxuHT1MbLYqcS7tAdUfoMVF1og589K4k5XxTc9-kqtYNh77vW2l9JlaV2xeknHIZH8-JMhECzaBjbAH3QWOhVWBnRW2RvXyrTNuAGhhqOLDucI_frFMFWUqQsqnY7q2CW6LSjZnukYrAmUuETV8eNSzKnHOURbHsTiDjKSEgc82NeJrEkEgt1bgn583Q-fnBjoiG9keWQ4ZSRzBzusFC6If5-85kSrEIqgpmfWCwKc1k7Otf_zqjYoCUEVG8ey1iIDXSzo6CEpEZ2GCQQtpF2ViC3pDZlcQ6gFdRittdkx4e8hjDykbWI-dSiD3N1BKJ2khYFjLnjctBLBnTkMMboXvr1BNHEjefGJJuRnzTX0q03st6Eil_Pzi1PJ_8iU3-cy_nhkORqbc9OIJZYmNJWkA08Ex4nHaHs4y7siaIxyYDVllCFAjupXmDrbKG3bJ34G3k6Kof2Z-fVHnaYsHxdbihV5hxVX6pP_0aTN-GJ36l_2plNbx1lHfjtDWUe7qLsJNqyBfN31xUc4IeJnJUJvMRaxXY5J8ahaGZNQk-AFMXu1nL7Ro91NckDtyb-CAWn4-iUrrCzG5A-OOFs9CbMfKO4n_Z_HGj29j-AKcmVfZSuGGqylRPEACiDbEV_6owq-Cd5qE3p6ZuEcqZRv1eZDoGM4S_R7JGEOK904gUnm3vTUfrpVLaSC0frycdPw5TKc7ky7RtsV4p3JNEFwFAIQeOrjjljIFNinqAVAAA44t5YMT7ANDz6HyPkc9uKs5jLZYJsUU1aBHK-3RE0YjpgsAG8HrtdpuD-DYEXiRPTLZhS1bnSSjdtDcWXlGctHBwAaNWUxR-Hq7kXLcUl9IsVHjHots2_4WiGsIjqxYA41cxgwqFuoiTm-_Rpx0APR_UX8eoQbellJvbQYsZryaqumwXDf0cGA9DSshf-98Asi-aHjlea80SlmofSPS-H0ysa38pGFhrey2gePEDBZHOXq2txZIDOa7zaUBijOLdTj-2YbY8undrH0ybLfkvLD3FFqnXqa4ZN4M3u3hdpzoCE1oyKHmN9cawFZWPt-6AEPbCXFV93pk_wBptmbGP-xTNM-Vt-hDqZNBECD-5EU0CZqJzYMZlR-4qADrhsfSzHeY41iSgMv-h5oz_7vB2w9uMnGRZtGfJc3dpotIP19q3JO84Ebd4vxtYViF-QETT6mfsGbIsRrue-XzVg34a_owpGENGG_vIVWd6Em23ZxysOBBGnAdNwe7Lyb6iB3sVBi0Y8YW7uyhuAloXeIR8m4Zn5LLq1CUKTDvSsv8I7fUGULmSnnGFQJlVu145dxgrqXfIhy-1GlQU3B5VbX_CxhjOAO8JvjrUpJIVSIiDf3ZMXs5SdcmJjlJ6JBfGueuhOX443j1CFac2C7M9MoTk3MMo2gWVNdVEE-e6IxkB_1xYI-aOFC9rRR4d2z2DZqQuNMxTBW6A0Yj9x_mup-IbiW6UAxd5xXTu1L6U0eFF5uwk-DvocihXlf_1p1CLlNDCEJTjD5NCfKH9EkP78Vyloy2Tp7UkYnt7FSjxfTshDpgnFjryCcYKpCHFnjxFL4RbQT-4MpVADoEokegffOyYJ2UOgYxBObQ3KfFLIugKIFqE3WzDiG5AKITv5uDcjl4HCczuLz3HjsEQ1T210lbjm49fxU5It6oLP_Kf4T9u-4EsnS05ZP6nj43XM4K76nLQ7HUl9R40x7nTAlddsRkKz0tqAvXEh3r9JmJe9dx3Q-Ctfaw7PXTtHemGxJ1H3DkbZWMsi0lS85LO1bxq2F7RnKPWEbmGgvUyyKsr9_Qiuv1D1vLzLA5oRd8BxfugoDh45nHVsn7qRpg3WD1-kPCnouqOaBEjlKg3yGDCsFA8xVIw85whaWOa7Sv2qbNzCavjyUw5FQdMtGvAhAjCx8CpAiU1iU4E6oOI4ypA8-zw4xsHxz8Xp2YjXqE7F0WBkNBnFKdWGvGiLH1ewUp5aPJD-acCdO7FoAfhYBI7GoU89qLUwGAQOz6A2y8O4ytw5EXV2QsHr4MwbEQ89Kxe_zmCW6uEIIjqNf0SIBiMi_iRtTXSoIjb3FppbJJ2or1PuQhD-G0YddGLWZWgW5ESX7-zHqVbg9n3h6oMECxMh_88y-JF3VpaUm86w-2Tgy1o9OvQRY3qnmdvvPdF60Iz1RfW12s55Shsg7CblSlL6yCh9QcNsMGMyhgGb8LGuvrIKKQwlIOXhBYo7gc_LN9oVP29SIR9F2cg01YdRUAazPeQQQ&cid=CAASFeRoUE67nl6YFpbIszb0Dt8tfcWosg&rfl=1%2Chttps%253A%252F%252Fthreatpost.com%252F%240
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
60dc86355a726817f9b9a0bf4504753a7c6c61e3bc7f6d9dbea1d101e76b015d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:29 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9455
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/ Frame 4119 		3 KB
579 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 30 Nov 2021 07:51:28 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 30 Nov 2021 09:08:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 30 Nov 2021 09:08:29 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4119 		1 KB
880 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:57:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
640
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
853
x-xss-protection
0
server
cafe
etag
7170004918125193417
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:57:49 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 4119 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:41:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1625
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7840
x-xss-protection
0
server
cafe
etag
9525834815172239946
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:41:24 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4119 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:24:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2632
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:24:37 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 4119 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37119
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1636547677202025"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 30 Nov 2021 09:08:29 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4119 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:48:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1184
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6415
x-xss-protection
0
server
cafe
etag
16810888504096353422
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 08:48:45 GMT
163b3e9c260ab6fd774ac5b5c6fd1d76.js
www.gstatic.com/mysidia/ Frame 4119 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 27 Nov 2021 16:21:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
233218
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11360
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 04:29:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Fri, 25 Feb 2022 16:21:31 GMT
JS-60006,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3E... Frame 1A0D 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA/JS-60006,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:29 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
id
id.sharedid.org/ Frame E95F 		0
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id.sharedid.org/id
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.210.233.105 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-210-233-105.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
expires
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame FBFF 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48420
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:29 GMT
vary
Accept-Encoding
pd
u.openx.net/w/1.0/ Frame 0BAE 		668 B
718 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
7d242e71104487a2042b6038b55d7b7bf107756e956b97074077552914cb0ebb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 30 Nov 2021 09:08:29 GMT
content-type
text/html
content-length
417
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
async_usersync.html
acdn.adnxs.com/dmp/ Frame 1AA3 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Sun, 28 Nov 2021 05:36:04 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Tue, 30 Nov 2021 09:08:29 GMT
Age
12740
X-Served-By
cache-lga21972-LGA, cache-lcy19253-LCY
X-Cache
HIT, HIT
X-Cache-Hits
4, 89369
X-Timer
S1638263310.770029,VS0,VE0
Vary
Accept-Encoding
pd
u.openx.net/w/1.0/ Frame C6D3 		668 B
730 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
7d242e71104487a2042b6038b55d7b7bf107756e956b97074077552914cb0ebb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 30 Nov 2021 09:08:29 GMT
content-type
text/html
content-length
417
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ixmatch.html
js-sec.indexww.com/um/ Frame D0F3 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1151
Date
Tue, 30 Nov 2021 09:08:29 GMT
Connection
keep-alive
ixmatch.html
js-sec.indexww.com/um/ Frame E417 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1151
Date
Tue, 30 Nov 2021 09:08:29 GMT
Connection
keep-alive
async_usersync.html
acdn.adnxs.com/dmp/ Frame 55BE 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Sun, 28 Nov 2021 05:36:04 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Tue, 30 Nov 2021 09:08:29 GMT
Age
12740
X-Served-By
cache-lga21972-LGA, cache-lcy19253-LCY
X-Cache
HIT, HIT
X-Cache-Hits
4, 89371
X-Timer
S1638263310.806535,VS0,VE0
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame AA2C 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid4.43.0-2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48420
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:29 GMT
vary
Accept-Encoding
sync
ups.analytics.yahoo.com/ups/55986/ Frame E95F
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
  • https://pixel.advertising.com/ups/55986/sync?uid=YaXqDQAIZSEhowBR&_origin=0&gdpr=0&gdpr_consent=&_test=YaXqDQAIZSEhowBR
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YaXqDQAIZSEhowBR&_origin=0&gdpr=0&gdpr_consent=&_test=YaXqDQAIZSEhowBR&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
0
330 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YaXqDQAIZSEhowBR&_origin=0&gdpr=0&gdpr_consent=&_test=YaXqDQAIZSEhowBR&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YaXqDQAIZSEhowBR&_origin=0&gdpr=0&gdpr_consent=&_test=YaXqDQAIZSEhowBR&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
date
Tue, 30 Nov 2021 09:08:30 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/57304/ Frame E95F
Redirect Chain
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e&verify=true
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVAxNWQ3MWIwYS01MWJkLTExZWMtYWU1ZS0wMjBjNDQyOTY3NWU%3D
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEMZe-LQWVs-WGNPA3xvNIqk&google_cver=1
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMZe-LQWVs-WGNPA3xvNIqk&google_cver=1&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMZe-LQWVs-WGNPA3xvNIqk&google_cver=1&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMZe-LQWVs-WGNPA3xvNIqk&google_cver=1&apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
date
Tue, 30 Nov 2021 09:08:30 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/55953/ Frame E95F
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=baec76b8-1fae-471f-8226-e5fbe7c59c0c&_origin=1&gdpr=1&gdpr_consent=
0
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55953/sync?uid=baec76b8-1fae-471f-8226-e5fbe7c59c0c&_origin=1&gdpr=1&gdpr_consent=
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ups.analytics.yahoo.com/ups/55953/sync?uid=baec76b8-1fae-471f-8226-e5fbe7c59c0c&_origin=1&gdpr=1&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
267
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame B8A1 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:05:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
177
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9475
x-xss-protection
0
server
cafe
etag
15988442915344899701
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 09:05:32 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame B8A1 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:07:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
46
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 09:07:43 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame B8A1 		0
571 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuseS0l9RRegCWP9PG_ACE4NrIjBk9DEwF8q6QHEt1cs5q520kn_riDJeILDBZ8BeVC2D6Pse8r93krzNxTuIgKbpobG4JsUGPnYedfsOa0bHsBfMNACAzswhkdsbao95Gy8eM-UBLsAF7X9FQ96o4NlHqhA1kbP1drjRI20IdD5mmPySbOH3YOyKJSbwK4fAhmOCApuGcgcRH8k_tZKW-Fi2prNB0oOejN1POypUc8sQikKHr-Ot2b1ca8fs_o_Iu1xyUBRtPohWWktz39jFRwqrYxR_-Z9GL8EsPaA29TclNdqDexfl7izyYdaVdsgZS9nID_8p_jzihZNBu0DL0mwu-VERJboFVAweyfizOwhD2fV5HeIIG68zlNJpY9YQJiTwOY8Ok5OrXuofP-2zBTlymF78nbZzczL6ahHxvwRjXCvudKAJ-TjiMM5ucrsWozY9jYtm3xdcC8h7r_a_9mUA06FFlueF23Y6g8OdPe5JU8Z7GnyN5J_zPC4lhw_B0mjHEx12fNzVdOJgyDmdXfZPF3UrMAelsz3dRMSeq6ET3XBfJ-AsD9AqnYkXIjvLe51vEBOsRiczX9VtsImw55wBI8J3q0JPZ5PCZd9gAHVCsa3THoE28VdGFK-jDmCGcrW3pev6ERxOMIa5idRJK2A0gj4dD2uGnZR8h4AK-vGSBMBQvUv0nkz741_rx3eVzBQLOO3cR32hg8Mx_2Om1ivQ1D2ZZxBaF9xbL3piDJQI49MIOI52ai0WMLCOibb2WV5UNYDnaGGHdY_zHTycfIbzenokABXCltuZvd65TcunrXWs3OITp47xJyRLWv_dNGcPvZG9_0BNukOt0RDwjstGh8OM3b6GU-itqAuA-V-I7KpCDIt5DQhVZYTejlnsGQJl-vIystefs7avYUh_w08aeJLna5xImU7h_cArruNEcuZcVCeMCZtazqO1j5FR2wAatRte1uwImBVNShbCLNDvFYs8U5zb5rCIujkb8sYkcsQpuweNEG75110lLAXFdk_EYk6jIAPrP4uPHFxPCsAm0tKWn6gTQCHhkE96hvTZpSwKh7iDfP0XIVjARZiWhuAsPxgyLnXbVsF9scx4YvUzdaIMADZwr1NB5KGLHn6obY6d7TUlWcprdDpqRTpdTz6fjH&sai=AMfl-YSem3rdYh_EorGXZtiISV4rNyDCFd_P3GZaN5QV5R_FVn1Zn23pryBvfIcbQUExisl5NkQ28kwb4A-6JOosFjsFUeGIe-22NgZhynPYLeEYRS4wLzN0HjA8Yaw0_7_5YeYU2hou93P1RKv2F4HsgRiEq4aAah_k-Dk_3wQ&sig=Cg0ArKJSzH1cnJTko_0IEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211111.18426&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D6hQ-C98Pn8uABdSMwjfWeJPJWq8zClYg0pbhCbyb1qU9oMiK6Plhmbi3lyFRFvbvLe8R33TqjThwuvY8SYqtf9t8-GVJyy5JJKrls8__y4G601EzKKmoNxfnpIu4cpAb6tAjdrb4DW0CmLCXH9Cb_FW-3Hg&dbm_d=AKAmf-CT60WQClozNQuwVziJSe2HQ_ysjy_CKc0j9kQzBjRAjJM7rjuvYLlaInpg2MT6mEdLv-Mr0B82CSoqZTAbmkaHlJOqUamdxa38nxFUCv40xAn4JD2_AhjpBAJOPnD_Uj7UoRG5YT5z7La4zg7jRhBnEk7Gu9_px77GZabGN9dYp_BswMjbgrgs14EiUuVV6zcPfKbK2KXfk32rtDMh_qmE-xvUUWs2gCOj66Qn5d21oAXfUsWq2b4Ck2JJ7hsu_vuSXjwGR_qgdQ0-aLysBlWE3-cRU7XM6aeKC_WqP-s0Do68rlilWT7Es-w3PyJpNUK8_HuKKYj75V-B8kwX3BYaPiu5hBwbsIA4AUcPr2HgGhyxnYA7swo1Cv7TCenAj1GJiEr4bhzePS0JfitW7z20IvSKz-GpjOytLeZH5v_uoG6E42qnherpg0OoSgHVffp148JiBrXtv-QcHYmJYZ94UKqaS7oVebU1FEp10QWPJuUUCku7eTJTn1fuCijvXGzS22zaY0G393dEgLe4yJVKrhVqpfjMyRUZyQq-gOA4nKHzZf_-O08x3He0cRm42E0DDld44IJzy44TMrb4SAvcM5CLeVX8vma6vUSi40qTnU5TUmS2-HQZ2BDvb7T3OhpB6RkJbuySueozIv49Blzvr_D091SyUwxTRP_pDC0rnIXhDYiRJs7dnf35KZ4SbjDGXtfkan_nmugnTSrzE5HnagYXFoIgIsWGEIiKTtShT8eU3Wblft0TkVNuaPQ47j3hPFlITXVL2U0rNoWJdi6gpG004NTQyE8SVvkX48tIyujK-zhdGF7eX8j2JBycLUMgPDMPs2aOg24UTC7Wo3SHwryRPLOQYw73FqMPCzHKUi8r4kQYLGLbA8iOAsQniCDGtpqAD28YAFhwn_qpzKDKyvIXWC0kARzJEXbdto6w15IJdNUAqA42KLkZQviN_P6Zphqv8_yAueEWiS-qgJjXGKp0BuEl-A4Y11uDL9uM6iXRziUfYjvNyzlbRvY7d_U8UO5qdPb9bIgI8aYwWRtchVhRUV35k4y1wNGQ0Ha44FXvrhTegxV9_KXv20aVxcg-Ecqbz2Fx-f6sTYzRSGS5aGT8vcss9hI6n2DyzR1abZU7VXyTNtil7DYbxkkA7m2gVsFNIVK38b6SoRG2AWtvwQhd1-vUgyATeQ_UWfXHWHzyoEaw7knF5EJR2xQa1U0gIxYKs8vxpWcUY65Y86PJmKMukfWK6GbVLllEt5IgTReompEBQr1boysZAdcOEYqaRp36A4U-QJ41ZglOHjD1F7lZU09Gt6JICX-35SR6PmDZKr7bR3JK7Jgmz-BlwgBs6ywCgy54lPzjyw5rdktoUxeioIezM0wBvP2vfwt4QOA1jFkJGZXXunLTLDnc9f4SKE2vy1UvbElLovABNPL6uqqsJ5DQ-Z6lpAuQx-iIqD2Gyl1fpRZ__ZJ6OyFivk5uWnErwrtJ06cxbC0pkPZxhzgI4Sm24yXNiJoy3g8R0naSGSnsciSEegzO79CR4Uc4dN5l11o8jLNSfPdqDghuqgtkFZnJJgh7GAJY1omP39TbIB6i8tgIj4_ddfDdnKrNAAaLLroV5jdAbKp2O9bpCEH7M5W03cKx3TVePI4jOv4Q-93KNKOVCtLtyuP9Rk2u6Be2H8zukxpN6iYTQPnELjtC_dzMSPIz5ilJbh4jQ1RI99vYw0Xjx6VwVG5dcCros6nvr7YltC_gZ0n2JUxF2tF42DzG93yw8JXVqzZP-zm2ayytRpGAwmda1E_vCOtjSq91XEE5UlDgWxDCWEBySq0N5WLWYVbEJBhh2liZx2DUk1WErMy2wvorPzipUZr1W_AceeJPs36m1OagH1cIjQ__qXMJpOaUIqidepSbuJcLyXfL25kg5IQaZYODMB7krt5lHSP2hNSQ4kJb_3Gn5IzYUatsZuLmK7vrlGqCHYDP3n4mbnz9JzrMwXxt2CUlxjRe49wtTCzl6KQSwkmehp3fc58lJKxb1fEht24qQH9C7yjf196gx61aIlNGVv3AqrFnrkoVG5XhtBPChsL9gDd_iwRuRPwL9ss6Hhm22AAgiBjkbJA6ltXMlz8TEiBj6WLQ2bwXjqe2JjLsb2byApPBNrCCTa3c9dHSs_296bX5ospfOazUQFDKl5ZSF5PLa3MrHSbobJFGob8HWKgW_0K-dp2sCiUTwrRzpf98LPaK4NbYdOKvfvZKgUdGZDGmN8-raxjUdt-AT11XtSAfyUhfLcueTitNq28yg-fZBY9LQHm_9nhRHIpd603nz8w20AesTFIQubTeBjH7AxYyQnYhBFJWFZIQjcozi1aAX6S9HWnGP8KFsGUNui5IT3BOq1X5015Tzie9dzwiEu4D14qiz4YV-_CISUxf_64-ZmlC45GfdmUIyeFhBl14tXafjBPDUwOP0Xo5FBDTEB0kk_aX1yAbrSiPtwVR6Z_OB_xpJiiXLEeXeERWcjPxBRKVssrqRSCkAIHVyq6v6lsNOUh9g9hB8Vq3bf2f_Tr2Opv2BhV6ZW_OeQWl9F08JR5_jQdOJvaWdodiDLnjznIBFzJ77DVYsa-CUcpxds10n19I-wxa4r1KkOcf-mgahuteL3H8hCQ2yW3RcFSyZFzvL1AGvFLLl82kRWsdcee3fNiyGfY7LWp46bYHv7-Wm3VILN5LuvWmZNS8u-QmfPKylG7EF_DRCuqqcTjHO4j-ONWxOuVnu80NWg8NxReBFXWwsUp7a-XZG5XrABnOZW-yC1TmD_m7IcLMFVAJzMN4H9SlP6XTMjnEfRWP_S9jtr6AS4KygApEzhJfYONWuSn8ASwaCj7m4__LZ76mAt0gnafmhe8ErU7TIQRLzNaWrV__UirO_phS8EDa47rFBsnVvLlF4oMncjMROsPsHcK6hqoIlVh3lHpUP1eRt5XxrIrwC5v5dbhXXgHpVgZN367O3Jvs1Yw-E5vgj8HRmNYidoTnKeC7VRkxuQY4uy6Hh9dXD8lsOphhwL9VOmjII4yPfOVrx94D2KAqczmwA9HywVD6pysexwAzHDnCa-7bmy8vhrEi0Uc1rd9RL7bfSfvllhn_YbH7C_TkqwDSdt08g0J5gzfvFg3evj1usvt4Ymj4sT29o02dZ887gjYoEDIna3o33A63PboWEwsvUnrIIHm-cNQ-eMjpIPkjo6VbQbSrViJx&cid=CAASFeRoS7rBtuil-pemNiC-iCblafGFHw&rfl=1%2Chttps%253A%252F%252Fthreatpost.com%252F%240
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Tue, 30 Nov 2021 09:08:30 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame B8A1 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 12:44:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
73429
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Tue, 29 Nov 2022 12:44:40 GMT
12813688582912107926
s0.2mdn.net/simgad/ Frame B8A1 		63 KB
63 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/12813688582912107926
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3d59e547271d44343356cb9986a13476eb76bb068a8c0549b9e2ae255721f26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 17:52:47 GMT
x-content-type-options
nosniff
age
400542
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
64285
x-xss-protection
0
last-modified
Thu, 18 Nov 2021 17:05:29 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 25 Nov 2022 17:52:47 GMT
rum
dsum-sec.casalemedia.com/ Frame 7B84
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0&C=1
43 B
1013 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0&C=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY2pakvAEwAQ&v=APEucNUVygIjliIkBwdyFJgFaGqPmjom6tJTRcnXT7GkD8yBdmU5jtsbd0Gktuv9ZjewpMMNl7lC_E-BtM-JLx0f9uuC96GKXjgKoS0XeOP70BI71pb1vX4
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
319
Expires
Tue, 30 Nov 2021 09:08:30 GMT
rum
dsum-sec.casalemedia.com/ Frame 7B84
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgdpr%3D0%26google_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=casale_media2_dsp_secure&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0
43 B
1000 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY2pakvAEwAQ&v=APEucNUVygIjliIkBwdyFJgFaGqPmjom6tJTRcnXT7GkD8yBdmU5jtsbd0Gktuv9ZjewpMMNl7lC_E-BtM-JLx0f9uuC96GKXjgKoS0XeOP70BI71pb1vX4
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=0
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
324
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame 7B84
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAhERPXqi6p0DleEtiKnfnU&google_cver=1
43 B
1006 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAhERPXqi6p0DleEtiKnfnU&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY2pakvAEwAQ&v=APEucNUVygIjliIkBwdyFJgFaGqPmjom6tJTRcnXT7GkD8yBdmU5jtsbd0Gktuv9ZjewpMMNl7lC_E-BtM-JLx0f9uuC96GKXjgKoS0XeOP70BI71pb1vX4
Protocol
HTTP/1.1
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
924002df-2756-4536-bc5c-19059b5275f1
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEAhERPXqi6p0DleEtiKnfnU&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 7B84
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTEzMDcyMzY5MTc2NjE0MjIzNw%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTEzMDcyMzY5MTc2NjE0MjIzNw%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY2pakvAEwAQ&v=APEucNUVygIjliIkBwdyFJgFaGqPmjom6tJTRcnXT7GkD8yBdmU5jtsbd0Gktuv9ZjewpMMNl7lC_E-BtM-JLx0f9uuC96GKXjgKoS0XeOP70BI71pb1vX4
Protocol
H3
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
37bf6a89-8dc8-4331-b7da-6f3b6a8f3916
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTEzMDcyMzY5MTc2NjE0MjIzNw%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
n.js
geo.moatads.com/ 		84 B
257 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ol=495721436&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=0%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-aaloXHTrNoanMCBLaTMratT%2F8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-3jLzQ%2BKAS248Xw%3D%3D&sc=1&os=1-hw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=YAHOOVIDEOINT1&hp=1&wf=1&ra=2&pxm=9&vz=-&zp=0&sgs=2&vb=5&cm=16&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=8&f=0&j=&t=1638263309391&de=541895839812&m=0&ar=553ffc12ef5-clean&iw=515795d&q=2&cb=0&ym=0&cu=1638263309391&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=Yahoo!%3A347687%3A1799672%3A3651557&zMoatDAC=-&zMoatWRW=-&zMoatAdReqDomain=threatpost.com&zMoatAuctionID=1362287899579984651%3A1638263305966&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&id=1&ii=4&bo=55&bd=0&zMoatOrigSlicer1=55&zMoatOrigSlicer2=0&zMoatDomain=threatpost.com&zMoatSubdomain=threatpost.com&gw=yahoovpaidtwoint215831825037&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A1493%3A1493%3A3251%3A2013&jk=-1&jm=-1&fs=195402&na=415472336&cs=0&ord=1638263309391&jv=1641739149&callback=DOMlessLLDcallback_52088558
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/yahoovpaidtwoint215831825037/moatvideo.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.67.38 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-10-67-38.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
971782c1fb8c1616186dddf59b6427d9466ffe0ed7f1e060e11382952c878748

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
max-age=900
server
TornadoServer/4.5.3
timing-allow-origin
*
etag
"e8ddd8421c2e992a1a008f014a58d2a24f735fa0"
content-length
84
content-type
text/html; charset=UTF-8
v2
mb.moatads.com/s/ 		186 B
361 B 		Script
General
Check archive.org
Download Go to
Full URL
https://mb.moatads.com/s/v2?url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&pcode=yahoovpaidtwoint215831825037&ord=1638263309391&jv=1934577624&callback=BrandSafetyNadoscallback_52088558
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/yahoovpaidtwoint215831825037/moatvideo.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.179.78.10 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-179-78-10.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
c5175b5497c68d79183db6e5a431a038ebdbfddfe5571434a1ad43f2453351c5

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
max-age=900
server
TornadoServer/4.5.3
timing-allow-origin
*
etag
"943a4dc0d591c0a3654c8bfeb45b7e67a02a6b5b"
content-length
186
content-type
text/html; charset=UTF-8
sd
us-u.openx.net/w/1.0/ Frame 959A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY1Y2kvAEwAQ&v=APEucNXKtfKkZpJagbbEl7SbK6_S-awmAfb1eW1UD08aeVVJ-GBEUTZemE_B_22dyJWspvDlKEegBoj0eWVTRx23FbB2lhhm-kh115Y9uih8HN4Rcw7hpYU
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
306
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 959A
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY1Y2kvAEwAQ&v=APEucNXKtfKkZpJagbbEl7SbK6_S-awmAfb1eW1UD08aeVVJ-GBEUTZemE_B_22dyJWspvDlKEegBoj0eWVTRx23FbB2lhhm-kh115Y9uih8HN4Rcw7hpYU
Protocol
H3
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 30 Nov 2021 09:08:30 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
um
sync.teads.tv/ Frame 959A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
  • https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY1Y2kvAEwAQ&v=APEucNXKtfKkZpJagbbEl7SbK6_S-awmAfb1eW1UD08aeVVJ-GBEUTZemE_B_22dyJWspvDlKEegBoj0eWVTRx23FbB2lhhm-kh115Y9uih8HN4Rcw7hpYU
Protocol
H2
Server
104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-245.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.6 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
max-age=0, no-cache, no-store
expires
Tue, 30 Nov 2021 09:08:30 GMT
server
akka-http/10.2.6
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
292
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
um
sync.teads.tv/ Frame 959A 		23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK6tiwIQ-qSrhAMY1Y2kvAEwAQ&v=APEucNXKtfKkZpJagbbEl7SbK6_S-awmAfb1eW1UD08aeVVJ-GBEUTZemE_B_22dyJWspvDlKEegBoj0eWVTRx23FbB2lhhm-kh115Y9uih8HN4Rcw7hpYU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-245.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.6 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
max-age=0, no-cache, no-store
expires
Tue, 30 Nov 2021 09:08:30 GMT
server
akka-http/10.2.6
content-length
23
content-type
image/gif
sd
us-u.openx.net/w/1.0/ Frame 665D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-Ahj8rcu5ATAB&v=APEucNUPKKdaNb2UqW5LdOMpf9CTTewVMlTAPPffIgjnUYK6822T2BfKUVplvDXZRLh7c-GRbr92qaChMo-XclzKrK4DFIUypnFj79g8oTEiy67UrAo-kFQ
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1&gdpr=0
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
306
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 665D
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&gdpr=0&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-Ahj8rcu5ATAB&v=APEucNUPKKdaNb2UqW5LdOMpf9CTTewVMlTAPPffIgjnUYK6822T2BfKUVplvDXZRLh7c-GRbr92qaChMo-XclzKrK4DFIUypnFj79g8oTEiy67UrAo-kFQ
Protocol
H3
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 30 Nov 2021 09:08:30 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
um
sync.teads.tv/ Frame 665D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm&gdpr=0
  • https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-Ahj8rcu5ATAB&v=APEucNUPKKdaNb2UqW5LdOMpf9CTTewVMlTAPPffIgjnUYK6822T2BfKUVplvDXZRLh7c-GRbr92qaChMo-XclzKrK4DFIUypnFj79g8oTEiy67UrAo-kFQ
Protocol
H2
Server
104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-245.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.6 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
max-age=0, no-cache, no-store
expires
Tue, 30 Nov 2021 09:08:30 GMT
server
akka-http/10.2.6
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.teads.tv/um?eid=3&uid=CAESENPBtK-i8qzZacMijrlk26E&google_cver=1&gdpr=0
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
292
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
um
sync.teads.tv/ Frame 665D 		23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=&gdpr=0&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDryqX-Ahj8rcu5ATAB&v=APEucNUPKKdaNb2UqW5LdOMpf9CTTewVMlTAPPffIgjnUYK6822T2BfKUVplvDXZRLh7c-GRbr92qaChMo-XclzKrK4DFIUypnFj79g8oTEiy67UrAo-kFQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-245.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.6 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
max-age=0, no-cache, no-store
expires
Tue, 30 Nov 2021 09:08:30 GMT
server
akka-http/10.2.6
content-length
23
content-type
image/gif
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021111601&jk=1960138878124635&bg=!UVKlUhbNAAZQLpa_UC47ACkAdvg8Wl38u-rx4JJv093GRaLJa_mOdddkvc40XrvUqpKnVvFY3hQjYQIAAANgUgAAA3ZoAQcKACaG49cdeqvc7CsHsfKMmNpqwsRWG8IBWEzPsDZwwhwBDAej5VDeo5kCc2kH4Du7uS3f4D2AgYZGXDh3lTxRoH6VwcApyKTGbs639Hj9oeIMFac7CKnph-0vXydnIEuW3232M9zP9eJyHX0S9onCeNtjCmOYwg9xuKRkYSaO74AKP0b9yW-8xXRw7yeIInjHooRpcwOJwEMxymurnr-nbe0-Ub9bFvhIVBEa1-fvVs2uvH4HOPjEINwleigRbbVkwmdZ_jp1J75ziRtYewY7g1IQELpvAaQhZ3vWh9ceY-0kSxPgi7-zdilMUrxu60AdoffaRxkgzl-uQF07aYOWId1N2UQLxMMJ5WnEvgpade1UtjdbRAWMU819_w1YvY3k1yjR84aRQnJH3-EtJpr7gA6GVaDSrP_HS-JAV6eiBHCyg6phMVsSuQIGmH6KkZqjQMYQz0Pric4uObopwh-HdJnWNzWR1fQxlJkCNyLIVHG4u2OYt-5HvBaNesP4nmw90V0DtuVXEkN9FcNkru8kqwpAnVdjwyWq6PFl9G8ifAXY7TA95HJsSY3mD93RNQg9sqVrQms_ATDCOty0PNBqrwBuZuChWvY-vxe-yiKtvzrz1iAXZOVAXfPFyRsOWh_jK9nIy5ukgjw_lIRZMJeo-y_kNJCVv88R_89MgWfv0Kf0awXVeYBE_jGj1rTnKCqlmboYD90aFbSheW_g3jS9in28bbsUZCvLtDHK_nuBFShBkNbjyzU9wAPZ69_zdPGJpzfiLLzKpuABR1bPGyhCYZdcbJ6SWX_7euMfMzI96XeGDwRuEyGKF_X9mxXmhC5sEt9ii1cTW7LL-U3XdbkPyBeuNl-Yzsh9aJje6A673md8kQAITmZCwPKvu-16Rg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 4115 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:05:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
178
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9475
x-xss-protection
0
server
cafe
etag
15988442915344899701
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 09:05:32 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 4115 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:07:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
47
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 09:07:43 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 4115 		0
24 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssXi9k3xicO3a6rYJ1G9wkI7PpVfkCuJgoqHlaDsg6X1i3GE9L4Srg1ibjTlXcjmBVt62Y28TqCF3QUnlrAvVXZ4fAKAjSOgbuOrjdu2J75nlEjjRMkWj10XxvwgXiBXDQqvf5mkco2vzReq1JM-JI9GAM7wLnNv1kaA0G_l9iezvHguWfoRKOHB5G-vmHxkwTEbJvM09eqCvHa0lTwRn86ZC-IwcBdWFXRtPoKeNe_d_bUhsli7wv2IKXmMR4oSqsFL8Dc1BlSv-AaIFd_5qvr_hp-cWHIgrlagRhh2wMJ-5sP_FHB9E-41vevCHJ4X0jMb_aFPaWLEszIed6hW-YBh0oMgm9v4Xr_rgqz4w-uZUsxGrSFFVQwnIcljfW7d86wPqpHXw2gELMJQq6xgqsxG0JE_JQ58O43LI72Of5RJyVEmnnL7zkFpl__vxRnlAKiUq-gEuonr7FMUczrcbW9ElP-Ba0UGKpxMnVAis7ZS-PgpifYVpuLgLZLwzeQWCm0x9KCWwNkWnW3bsUKnsh51Cx4pCAnuZJEpin8Lm-9NAQiG3Hd-ZznyCCI4u_cT_AIT1L1zMimAPipQ_J6jMo9Fyeyen5yrp0vd6ys3KSbgZCcOaESrzZDso8AVl7wJJjT6UW5BHD5Q_-Qq_-osVMJj6uo_kyicbU1gLIeup2k60Lr6CXSK79DjAzZQ3tTDS0XoeTJA5XayzMDotJJZ-epFyLANz3Cnh0VWeu3SiykVr2tJZkka5p7z2JVD8d4bjLtGY6FWOlSpvTtYwKQdCyJWWrQfXShXCc802ZWMm-kGiXAWirOXgOXASktgVXR13HE0klCbGFApHW7eYUVZpDcaGw1Pz_8Wip__9dGtjg0__LCmiELhNnn7xrg4ZiI2KxS1Ps0SbFBqPu4_s4PiGm7_wsnHY0zGgFgVkjcqJEO4gjBmGgg4hpzcvkq5cuD2pbpgeuycyOzFxrC1i0VEUSunxK7g8d5QFlfokFOSZXuq1Zryio_K87hEYT8ilke_8eqYYyXVCW50Y1EO_SZJSsGTE6NTglS2o6pWaiVrvymniD2G4jwLbbaPnsOLm_XNj86K4lgVp6xpNc4k1yidtcQ18lOkLTKQEtIM2yP1DBeUCxXfZzp8yPK6EENp7iOhUHwXZAgugHDL9ZrorM&sai=AMfl-YRw9zW9MUFSkzerfLHvlBxf98IICfNR2yYjIqDBvccS1wNXZGsg9_5dG40SL2yxvllXfR-wOgMiSPdlMlyA14VBQ-o1FXH76VkMUOddjGagg0j2TPWd5I-T1vPdBkh3t6ophkUE4-Ourr0pNyjETiaixFMwJOsW79jnqYY&sig=Cg0ArKJSzN10wynPLfnAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211111.51672&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DApZNhxgs-vWvknw2ZHo8WDJiFhouZ5iKaY8nldkYXQviTayxnb4qFYJ5N7FoxpayMlvOHGFmJ5-7tntfmSQhARZpWruvKOzNgnbSS3_lYxbpKQNOsGtW3hbXl_I95NRCaxK_csf0_me3-KJw3v3pzntHxkg&dbm_d=AKAmf-D1fpy4anRGGyAEZCQFBd-D2r6H5T938AMUBea0z_woofC9hjTp3KuBu97LCCeeCREErStzP92NSlDuzOWSjvCDhzjiYcxmUWsuFzKD7QkAyuN9xIl0Y4Eecn5Uevg3bCVhFFnqDc7NV5hd043tbu_Kvopvm1zGW_7wDPzKkmb-3zb_JMsrWKrLNLMwJvM6oZvP4rk85G4RqxqADWjGsrBtni7qXzCG75Ha7YbiuEbVWbQwClOwWwr9cSaajhsSdlXhkg_61LE8yGkF9tRRoq13hqxHWxpEGCod4jrmIxzfLMsIYd8oLUP6IDxv_vlYH3rE4jW9qCRi44aapJCQHdBMQ5PAEGd40EDKwDCDBXZkae5fD_U3ZT77I0_kZsigo5BpCiNyKTIVVek7jj6B1YVKuf3n6GZCfV6z9Jw_PiG5e5OS9147XHXdqMA26Dsc-Rjr6o9J9T1ai36KiZvE_g0qWiulL31bBEvPtWHg9Ha7HDpAtWMhCAXjUTINVeFFIOiIEc4nm01qNbPCypDlcyUKCEK_bTtsqy9cyYzpNpqJZKzcSeism53fjvgjdRFIngIiAuDrHtdQMFK9P9rSvXQLHbdK7mZq_zlQEf9twXjdBrHHqx1x4uSx2fUDOaDsCuxr2-v56ogtxXopgqgdbC_yi8ffOBdSa5HoXyijKUvjkYVMOVZkhdZYpPklMxy0iOH2NC1vY2p3JPemMPtktYxLxwM4sf4TQl1QCqsVBcIlJDmcqqr4N0pdlvVEa25smDd_eKlw9y7dNd1PiK33INBn3Lti3zvaQUZMKo2DHzDsG9PvocmPWTYZ1Frm9lyiarrTc0x3Uw5PNJm9vlRu93qf_htGAsuxr-TU2VioGutsbIz2AaoiFqZU2lrIvHAGU0bon68u4PMZsXjyvbJesz2oidGtBjKavkD3cRab7UIforMNA3tTnHAjg9GC_37Wn3wByqFvaBENB2nZcMu4Rtz559UBqukHoctKwC9affXWpGonStJAb3cdRR56Y2129mreCk1GyT7k_z-CLJZJJoBtTULQC0RhtTVzYZb_Vj9KytETSsDycjCMtvlE-7aZ0CwzEuqkR5TpDZU3-UhT68MV8DSYLqmqFrItS8KlvUunctrE50OBwTshBa3YHPQ5CWaJdCOAsAG9vjDz39pLaignAYOnz0hW60ixxr1DsJm-71UhgcGOzCYt0AGNZTnjqumx8h9afzUmf2YEQUd4SwEpXvWcQWVsO8w6uXgFnmojaKFFR_Oc3AKahfo4qm1pmtxybD3LEoILW8adUc2UHjCgGPW47jWFOuYoG1OVlJRrh1yxwSNTiJhsrPViwyRzFzGKpHoaWXzxTDg6gs35WBOa_wrt28ldf8sGqVJ2YTOKSs3xLyaVsfYWgXuFz5pDPfdRnNXmZIYY0yyfkon-grPV8cMwQ5u7JgiRUSH5ZDLvldjycbYRYhlQcRR8zPwXRBy4xWOLaoRMQFp7I_CqBpQx_Dw9QSIOV0eBlCsNuL-lE9Y2RPUIfx3mgyWLGky1NQwj0Ze_N88t5v3qOfsUsPsFJweT3G_aCLf-zaJdkPO24_lrYwGsDxndUwxsBlHs97P3ULWN-Im-4M0tN6EBrXvQOLJfpsRG7BDT0L3snwVf6bhYxFxYVuztazRKJjY0pCiTtJyH8wyDvaD9YYqMZsOfnE7p_mdy59qbU_UrwnieUwP_e4xe6ZbkmF8c1r0-j2YOB7YgAIU-KYxqz1NCuSrg82qxlNA6DRsx-GsQxUkA4gLdM-_S3_qQAxIOURLqCWPPwUdUImltHmABDZd3SjS5LMC8JnWhfkOTTYK3gBCWSivNJicGvOPd3zXK1WXGX7ra4pYarrLfdT9ZmVgi3lEB-3bknyPq9t7tMggN3JvYwMm00Vmy5M0FzftbzFUEoqx-9NcRNnxee7HZzKor-q34fOjWQGio6BCWe_38dWsJ4OKBYZtozmaso6IM1zRU9PRAIZwSfsRroGPjDCB7lbBxgCwLaiqGrDb1bSmKANU2I8A5uljpCm9VjgUhRDPXY3p1YhNTEIlyiyYieCRIo6IF9WlA3eoRg_EWZYb7nKV599AAxVMWZ5oIR6ZU6BGpb_chrhH5R2uqi5RdLJZjPLjV6Kz1Xq6Usk_GVD-xkfabpcPQ0_JtOlGEFer4DYAqqLxzglY72l-P6xylls8oqocMAXGIq6B_b0J4-mwWviq_-CTUbmmH_lsKM3OnfgTaWJhufTV2rti82prtR9AFpFYQMCF-SdYC84WULM7wD8hW1joJWhA3LoSyN9EZLWDNdJHKykiTDhzyjCHREnB3TpniYEGf5XyU05GkW5UzXiVzBKlebTTuJGgGoa5PZWiqXgdgjriBTOtcodwn2HISumB49fDxiC1sTJD5LFewGCjDPg1jleVY5b-p3I0NnUSUnl2396DHOxxhq2VVLpmUGaEN336az9BPh6mIzdJzoHiVm7uaEbDbNV5JB1PpksNxGzq6Yhmz8L1EJBOGCdYmiN9cGI-POgm4VMddptv0isfILHcc4C6d8aaB_QeCfZ5FJ3h9nhQ0QngWfr9urG-jlGdFhpYbXDElSRu4UMRV5YudQ_a_ygeqwZC0UDyN9507nFiLASSV6XYZjdc6_u-TLWT0IACbn-b7YnGM5UV8EeHM1UP_qcP7gW0jx9MD4Wt3Km-QetwYkLLPEcTWrw4OlpMlWit7HIaqugrYG1DlXSfznUpj-sFSscOjr-f2GPSRRcDgD2yvvBiQlqPKsc25yZGX5h1BsZUUCrT3sXq9MiyHCesuUWXwbB8CSEfoO58uLS1BYvpiz5qoZ07z9WeRp8BctNbjzNCzjQ8SwNlzWuiV_LXBtxICPbQjicWk1WSHOcpRY25HNAD9cDMc63apOdTlnOSwMQRfuRBtW7oBBGBzb221LyrLVPfelo3QTKDiYEl8h7-VZU0oXZ4V9ZSUiNRGfeogKwUPSA_MsUqskESH7oqSg_cMvEPS1QIc-NSQRBbkiGLihgHm6wCtv9hqFzsK6Bz0ZqspcgUPT4445a6pL_0ZwZvYtHNQ6_u5q9oFVN4XiZH7Q-eiqWTi_vavHjWF3NTR_cFnwwf3znUuNjjJYvcjgR9-NemiL_7z4is_o0QAUhZXtoOH3lQdVv4mj8bqzBa_qslXLP7oC-vpMe5blbiq1R0np34sVypAtEFl9DJ-0hc5P0aoZ9Y3IWcWhWJ1pU9W_g&cid=CAASFeRoZFdozcE_Jb4tqbjlpROFw0nN_w&rfl=1%2Chttps%253A%252F%252Fthreatpost.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Tue, 30 Nov 2021 09:08:30 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 4115 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 12:44:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
73430
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Tue, 29 Nov 2022 12:44:40 GMT
9347768962953226529
s0.2mdn.net/simgad/ Frame 4115 		51 KB
52 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/9347768962953226529
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7de3b7a3cbd73581de843bf06eb79f0d9d98039140bdc72cf783693e98e0f167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 18:11:31 GMT
x-content-type-options
nosniff
age
53819
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52716
x-xss-protection
0
last-modified
Thu, 18 Nov 2021 17:05:08 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 29 Nov 2022 18:11:31 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 2AD8 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 12:44:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
73430
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Tue, 29 Nov 2022 12:44:40 GMT
express_html_inpage_rendering_lib_200_275.js
s0.2mdn.net/879366/ Frame 2AD8 		106 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
Origin
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 12:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
73431
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37892
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:44:52 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 12:44:39 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 2AD8 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:07:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
47
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 09:07:43 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 2AD8 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:05:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
178
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9475
x-xss-protection
0
server
cafe
etag
15988442915344899701
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 14 Dec 2021 09:05:32 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 8A2B 		143 B
163 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

content-type
text/html; charset=ISO-8859-1
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 30 Nov 2021 09:02:16 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
374
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sd
eu-u.openx.net/w/1.0/ Frame C6D3
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=f0a061a5-ea0d-4f00-a403-cf47764996bb
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=f0a061a5-ea0d-4f00-a403-cf47764996bb
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
MT3 4133 baa842e master zrh-pixel-x31 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=f0a061a5-ea0d-4f00-a403-cf47764996bb
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 30 Nov 2021 09:08:29 GMT
sd
us-u.openx.net/w/1.0/ Frame C6D3
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame C6D3
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=834006166056631821
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=834006166056631821
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=834006166056631821
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame C6D3 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=4215b7d6-bd5c-7085-c952-aab32c8562ac&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame C6D3 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame C6D3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 0BAE
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=19a961a5-ea0d-4b00-9fe4-f5ca6e1eeea1
43 B
114 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=19a961a5-ea0d-4b00-9fe4-f5ca6e1eeea1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
MT3 4133 baa842e master zrh-pixel-x31 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=19a961a5-ea0d-4b00-9fe4-f5ca6e1eeea1
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 30 Nov 2021 09:08:29 GMT
sd
us-u.openx.net/w/1.0/ Frame 0BAE
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=pwGQTPRRwUC8VZdI9QPcSfMJwUC8AMRJpwlICjds
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 0BAE
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3779540836316986857
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3779540836316986857
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3779540836316986857
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 0BAE 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=4215b7d6-bd5c-7085-c952-aab32c8562ac&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 0BAE 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NmU3YTY0MWMtNzQyYi0yZTIxLWRjYjItZjAwYWU2NjdhY2Nj
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 0BAE
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHpEHZFUcTEsobRWZjv9Vb8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame B8A1 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuseS0l9RRegCWP9PG_ACE4NrIjBk9DEwF8q6QHEt1cs5q520kn_riDJeILDBZ8BeVC2D6Pse8r93krzNxTuIgKbpobG4JsUGPnYedfsOa0bHsBfMNACAzswhkdsbao95Gy8eM-UBLsAF7X9FQ96o4NlHqhA1kbP1drjRI20IdD5mmPySbOH3YOyKJSbwK4fAhmOCApuGcgcRH8k_tZKW-Fi2prNB0oOejN1POypUc8sQikKHr-Ot2b1ca8fs_o_Iu1xyUBRtPohWWktz39jFRwqrYxR_-Z9GL8EsPaA29TclNdqDexfl7izyYdaVdsgZS9nID_8p_jzihZNBu0DL0mwu-VERJboFVAweyfizOwhD2fV5HeIIG68zlNJpY9YQJiTwOY8Ok5OrXuofP-2zBTlymF78nbZzczL6ahHxvwRjXCvudKAJ-TjiMM5ucrsWozY9jYtm3xdcC8h7r_a_9mUA06FFlueF23Y6g8OdPe5JU8Z7GnyN5J_zPC4lhw_B0mjHEx12fNzVdOJgyDmdXfZPF3UrMAelsz3dRMSeq6ET3XBfJ-AsD9AqnYkXIjvLe51vEBOsRiczX9VtsImw55wBI8J3q0JPZ5PCZd9gAHVCsa3THoE28VdGFK-jDmCGcrW3pev6ERxOMIa5idRJK2A0gj4dD2uGnZR8h4AK-vGSBMBQvUv0nkz741_rx3eVzBQLOO3cR32hg8Mx_2Om1ivQ1D2ZZxBaF9xbL3piDJQI49MIOI52ai0WMLCOibb2WV5UNYDnaGGHdY_zHTycfIbzenokABXCltuZvd65TcunrXWs3OITp47xJyRLWv_dNGcPvZG9_0BNukOt0RDwjstGh8OM3b6GU-itqAuA-V-I7KpCDIt5DQhVZYTejlnsGQJl-vIystefs7avYUh_w08aeJLna5xImU7h_cArruNEcuZcVCeMCZtazqO1j5FR2wAatRte1uwImBVNShbCLNDvFYs8U5zb5rCIujkb8sYkcsQpuweNEG75110lLAXFdk_EYk6jIAPrP4uPHFxPCsAm0tKWn6gTQCHhkE96hvTZpSwKh7iDfP0XIVjARZiWhuAsPxgyLnXbVsF9scx4YvUzdaIMADZwr1NB5KGLHn6obY6d7TUlWcprdDpqRTpdTz6fjH&sai=AMfl-YSem3rdYh_EorGXZtiISV4rNyDCFd_P3GZaN5QV5R_FVn1Zn23pryBvfIcbQUExisl5NkQ28kwb4A-6JOosFjsFUeGIe-22NgZhynPYLeEYRS4wLzN0HjA8Yaw0_7_5YeYU2hou93P1RKv2F4HsgRiEq4aAah_k-Dk_3wQ&sig=Cg0ArKJSzH1cnJTko_0IEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=402&vt=11&dtpt=401&dett=2&cstd=0&cisv=r20211111.18426&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D6hQ-C98Pn8uABdSMwjfWeJPJWq8zClYg0pbhCbyb1qU9oMiK6Plhmbi3lyFRFvbvLe8R33TqjThwuvY8SYqtf9t8-GVJyy5JJKrls8__y4G601EzKKmoNxfnpIu4cpAb6tAjdrb4DW0CmLCXH9Cb_FW-3Hg&dbm_d=AKAmf-CT60WQClozNQuwVziJSe2HQ_ysjy_CKc0j9kQzBjRAjJM7rjuvYLlaInpg2MT6mEdLv-Mr0B82CSoqZTAbmkaHlJOqUamdxa38nxFUCv40xAn4JD2_AhjpBAJOPnD_Uj7UoRG5YT5z7La4zg7jRhBnEk7Gu9_px77GZabGN9dYp_BswMjbgrgs14EiUuVV6zcPfKbK2KXfk32rtDMh_qmE-xvUUWs2gCOj66Qn5d21oAXfUsWq2b4Ck2JJ7hsu_vuSXjwGR_qgdQ0-aLysBlWE3-cRU7XM6aeKC_WqP-s0Do68rlilWT7Es-w3PyJpNUK8_HuKKYj75V-B8kwX3BYaPiu5hBwbsIA4AUcPr2HgGhyxnYA7swo1Cv7TCenAj1GJiEr4bhzePS0JfitW7z20IvSKz-GpjOytLeZH5v_uoG6E42qnherpg0OoSgHVffp148JiBrXtv-QcHYmJYZ94UKqaS7oVebU1FEp10QWPJuUUCku7eTJTn1fuCijvXGzS22zaY0G393dEgLe4yJVKrhVqpfjMyRUZyQq-gOA4nKHzZf_-O08x3He0cRm42E0DDld44IJzy44TMrb4SAvcM5CLeVX8vma6vUSi40qTnU5TUmS2-HQZ2BDvb7T3OhpB6RkJbuySueozIv49Blzvr_D091SyUwxTRP_pDC0rnIXhDYiRJs7dnf35KZ4SbjDGXtfkan_nmugnTSrzE5HnagYXFoIgIsWGEIiKTtShT8eU3Wblft0TkVNuaPQ47j3hPFlITXVL2U0rNoWJdi6gpG004NTQyE8SVvkX48tIyujK-zhdGF7eX8j2JBycLUMgPDMPs2aOg24UTC7Wo3SHwryRPLOQYw73FqMPCzHKUi8r4kQYLGLbA8iOAsQniCDGtpqAD28YAFhwn_qpzKDKyvIXWC0kARzJEXbdto6w15IJdNUAqA42KLkZQviN_P6Zphqv8_yAueEWiS-qgJjXGKp0BuEl-A4Y11uDL9uM6iXRziUfYjvNyzlbRvY7d_U8UO5qdPb9bIgI8aYwWRtchVhRUV35k4y1wNGQ0Ha44FXvrhTegxV9_KXv20aVxcg-Ecqbz2Fx-f6sTYzRSGS5aGT8vcss9hI6n2DyzR1abZU7VXyTNtil7DYbxkkA7m2gVsFNIVK38b6SoRG2AWtvwQhd1-vUgyATeQ_UWfXHWHzyoEaw7knF5EJR2xQa1U0gIxYKs8vxpWcUY65Y86PJmKMukfWK6GbVLllEt5IgTReompEBQr1boysZAdcOEYqaRp36A4U-QJ41ZglOHjD1F7lZU09Gt6JICX-35SR6PmDZKr7bR3JK7Jgmz-BlwgBs6ywCgy54lPzjyw5rdktoUxeioIezM0wBvP2vfwt4QOA1jFkJGZXXunLTLDnc9f4SKE2vy1UvbElLovABNPL6uqqsJ5DQ-Z6lpAuQx-iIqD2Gyl1fpRZ__ZJ6OyFivk5uWnErwrtJ06cxbC0pkPZxhzgI4Sm24yXNiJoy3g8R0naSGSnsciSEegzO79CR4Uc4dN5l11o8jLNSfPdqDghuqgtkFZnJJgh7GAJY1omP39TbIB6i8tgIj4_ddfDdnKrNAAaLLroV5jdAbKp2O9bpCEH7M5W03cKx3TVePI4jOv4Q-93KNKOVCtLtyuP9Rk2u6Be2H8zukxpN6iYTQPnELjtC_dzMSPIz5ilJbh4jQ1RI99vYw0Xjx6VwVG5dcCros6nvr7YltC_gZ0n2JUxF2tF42DzG93yw8JXVqzZP-zm2ayytRpGAwmda1E_vCOtjSq91XEE5UlDgWxDCWEBySq0N5WLWYVbEJBhh2liZx2DUk1WErMy2wvorPzipUZr1W_AceeJPs36m1OagH1cIjQ__qXMJpOaUIqidepSbuJcLyXfL25kg5IQaZYODMB7krt5lHSP2hNSQ4kJb_3Gn5IzYUatsZuLmK7vrlGqCHYDP3n4mbnz9JzrMwXxt2CUlxjRe49wtTCzl6KQSwkmehp3fc58lJKxb1fEht24qQH9C7yjf196gx61aIlNGVv3AqrFnrkoVG5XhtBPChsL9gDd_iwRuRPwL9ss6Hhm22AAgiBjkbJA6ltXMlz8TEiBj6WLQ2bwXjqe2JjLsb2byApPBNrCCTa3c9dHSs_296bX5ospfOazUQFDKl5ZSF5PLa3MrHSbobJFGob8HWKgW_0K-dp2sCiUTwrRzpf98LPaK4NbYdOKvfvZKgUdGZDGmN8-raxjUdt-AT11XtSAfyUhfLcueTitNq28yg-fZBY9LQHm_9nhRHIpd603nz8w20AesTFIQubTeBjH7AxYyQnYhBFJWFZIQjcozi1aAX6S9HWnGP8KFsGUNui5IT3BOq1X5015Tzie9dzwiEu4D14qiz4YV-_CISUxf_64-ZmlC45GfdmUIyeFhBl14tXafjBPDUwOP0Xo5FBDTEB0kk_aX1yAbrSiPtwVR6Z_OB_xpJiiXLEeXeERWcjPxBRKVssrqRSCkAIHVyq6v6lsNOUh9g9hB8Vq3bf2f_Tr2Opv2BhV6ZW_OeQWl9F08JR5_jQdOJvaWdodiDLnjznIBFzJ77DVYsa-CUcpxds10n19I-wxa4r1KkOcf-mgahuteL3H8hCQ2yW3RcFSyZFzvL1AGvFLLl82kRWsdcee3fNiyGfY7LWp46bYHv7-Wm3VILN5LuvWmZNS8u-QmfPKylG7EF_DRCuqqcTjHO4j-ONWxOuVnu80NWg8NxReBFXWwsUp7a-XZG5XrABnOZW-yC1TmD_m7IcLMFVAJzMN4H9SlP6XTMjnEfRWP_S9jtr6AS4KygApEzhJfYONWuSn8ASwaCj7m4__LZ76mAt0gnafmhe8ErU7TIQRLzNaWrV__UirO_phS8EDa47rFBsnVvLlF4oMncjMROsPsHcK6hqoIlVh3lHpUP1eRt5XxrIrwC5v5dbhXXgHpVgZN367O3Jvs1Yw-E5vgj8HRmNYidoTnKeC7VRkxuQY4uy6Hh9dXD8lsOphhwL9VOmjII4yPfOVrx94D2KAqczmwA9HywVD6pysexwAzHDnCa-7bmy8vhrEi0Uc1rd9RL7bfSfvllhn_YbH7C_TkqwDSdt08g0J5gzfvFg3evj1usvt4Ymj4sT29o02dZ887gjYoEDIna3o33A63PboWEwsvUnrIIHm-cNQ-eMjpIPkjo6VbQbSrViJx&cid=CAASFeRoS7rBtuil-pemNiC-iCblafGFHw&rfl=1%2Chttps%253A%252F%252Fthreatpost.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:30 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
async_usersync
ib.adnxs.com/ Frame 1AA3 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
1007116e-6c1a-44c9-8670-959d545c9ac1
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 55BE 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
b2e1b9cb-2c35-410a-a2a1-7d5ff198938f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 6B6B 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Mon, 29 Nov 2021 12:44:40 GMT
expires
Tue, 29 Nov 2022 12:44:40 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
73430
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
view
googleads4.g.doubleclick.net/pcs/ Frame 4115 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssXi9k3xicO3a6rYJ1G9wkI7PpVfkCuJgoqHlaDsg6X1i3GE9L4Srg1ibjTlXcjmBVt62Y28TqCF3QUnlrAvVXZ4fAKAjSOgbuOrjdu2J75nlEjjRMkWj10XxvwgXiBXDQqvf5mkco2vzReq1JM-JI9GAM7wLnNv1kaA0G_l9iezvHguWfoRKOHB5G-vmHxkwTEbJvM09eqCvHa0lTwRn86ZC-IwcBdWFXRtPoKeNe_d_bUhsli7wv2IKXmMR4oSqsFL8Dc1BlSv-AaIFd_5qvr_hp-cWHIgrlagRhh2wMJ-5sP_FHB9E-41vevCHJ4X0jMb_aFPaWLEszIed6hW-YBh0oMgm9v4Xr_rgqz4w-uZUsxGrSFFVQwnIcljfW7d86wPqpHXw2gELMJQq6xgqsxG0JE_JQ58O43LI72Of5RJyVEmnnL7zkFpl__vxRnlAKiUq-gEuonr7FMUczrcbW9ElP-Ba0UGKpxMnVAis7ZS-PgpifYVpuLgLZLwzeQWCm0x9KCWwNkWnW3bsUKnsh51Cx4pCAnuZJEpin8Lm-9NAQiG3Hd-ZznyCCI4u_cT_AIT1L1zMimAPipQ_J6jMo9Fyeyen5yrp0vd6ys3KSbgZCcOaESrzZDso8AVl7wJJjT6UW5BHD5Q_-Qq_-osVMJj6uo_kyicbU1gLIeup2k60Lr6CXSK79DjAzZQ3tTDS0XoeTJA5XayzMDotJJZ-epFyLANz3Cnh0VWeu3SiykVr2tJZkka5p7z2JVD8d4bjLtGY6FWOlSpvTtYwKQdCyJWWrQfXShXCc802ZWMm-kGiXAWirOXgOXASktgVXR13HE0klCbGFApHW7eYUVZpDcaGw1Pz_8Wip__9dGtjg0__LCmiELhNnn7xrg4ZiI2KxS1Ps0SbFBqPu4_s4PiGm7_wsnHY0zGgFgVkjcqJEO4gjBmGgg4hpzcvkq5cuD2pbpgeuycyOzFxrC1i0VEUSunxK7g8d5QFlfokFOSZXuq1Zryio_K87hEYT8ilke_8eqYYyXVCW50Y1EO_SZJSsGTE6NTglS2o6pWaiVrvymniD2G4jwLbbaPnsOLm_XNj86K4lgVp6xpNc4k1yidtcQ18lOkLTKQEtIM2yP1DBeUCxXfZzp8yPK6EENp7iOhUHwXZAgugHDL9ZrorM&sai=AMfl-YRw9zW9MUFSkzerfLHvlBxf98IICfNR2yYjIqDBvccS1wNXZGsg9_5dG40SL2yxvllXfR-wOgMiSPdlMlyA14VBQ-o1FXH76VkMUOddjGagg0j2TPWd5I-T1vPdBkh3t6ophkUE4-Ourr0pNyjETiaixFMwJOsW79jnqYY&sig=Cg0ArKJSzN10wynPLfnAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=257&vt=11&dtpt=256&dett=2&cstd=0&cisv=r20211111.51672&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DApZNhxgs-vWvknw2ZHo8WDJiFhouZ5iKaY8nldkYXQviTayxnb4qFYJ5N7FoxpayMlvOHGFmJ5-7tntfmSQhARZpWruvKOzNgnbSS3_lYxbpKQNOsGtW3hbXl_I95NRCaxK_csf0_me3-KJw3v3pzntHxkg&dbm_d=AKAmf-D1fpy4anRGGyAEZCQFBd-D2r6H5T938AMUBea0z_woofC9hjTp3KuBu97LCCeeCREErStzP92NSlDuzOWSjvCDhzjiYcxmUWsuFzKD7QkAyuN9xIl0Y4Eecn5Uevg3bCVhFFnqDc7NV5hd043tbu_Kvopvm1zGW_7wDPzKkmb-3zb_JMsrWKrLNLMwJvM6oZvP4rk85G4RqxqADWjGsrBtni7qXzCG75Ha7YbiuEbVWbQwClOwWwr9cSaajhsSdlXhkg_61LE8yGkF9tRRoq13hqxHWxpEGCod4jrmIxzfLMsIYd8oLUP6IDxv_vlYH3rE4jW9qCRi44aapJCQHdBMQ5PAEGd40EDKwDCDBXZkae5fD_U3ZT77I0_kZsigo5BpCiNyKTIVVek7jj6B1YVKuf3n6GZCfV6z9Jw_PiG5e5OS9147XHXdqMA26Dsc-Rjr6o9J9T1ai36KiZvE_g0qWiulL31bBEvPtWHg9Ha7HDpAtWMhCAXjUTINVeFFIOiIEc4nm01qNbPCypDlcyUKCEK_bTtsqy9cyYzpNpqJZKzcSeism53fjvgjdRFIngIiAuDrHtdQMFK9P9rSvXQLHbdK7mZq_zlQEf9twXjdBrHHqx1x4uSx2fUDOaDsCuxr2-v56ogtxXopgqgdbC_yi8ffOBdSa5HoXyijKUvjkYVMOVZkhdZYpPklMxy0iOH2NC1vY2p3JPemMPtktYxLxwM4sf4TQl1QCqsVBcIlJDmcqqr4N0pdlvVEa25smDd_eKlw9y7dNd1PiK33INBn3Lti3zvaQUZMKo2DHzDsG9PvocmPWTYZ1Frm9lyiarrTc0x3Uw5PNJm9vlRu93qf_htGAsuxr-TU2VioGutsbIz2AaoiFqZU2lrIvHAGU0bon68u4PMZsXjyvbJesz2oidGtBjKavkD3cRab7UIforMNA3tTnHAjg9GC_37Wn3wByqFvaBENB2nZcMu4Rtz559UBqukHoctKwC9affXWpGonStJAb3cdRR56Y2129mreCk1GyT7k_z-CLJZJJoBtTULQC0RhtTVzYZb_Vj9KytETSsDycjCMtvlE-7aZ0CwzEuqkR5TpDZU3-UhT68MV8DSYLqmqFrItS8KlvUunctrE50OBwTshBa3YHPQ5CWaJdCOAsAG9vjDz39pLaignAYOnz0hW60ixxr1DsJm-71UhgcGOzCYt0AGNZTnjqumx8h9afzUmf2YEQUd4SwEpXvWcQWVsO8w6uXgFnmojaKFFR_Oc3AKahfo4qm1pmtxybD3LEoILW8adUc2UHjCgGPW47jWFOuYoG1OVlJRrh1yxwSNTiJhsrPViwyRzFzGKpHoaWXzxTDg6gs35WBOa_wrt28ldf8sGqVJ2YTOKSs3xLyaVsfYWgXuFz5pDPfdRnNXmZIYY0yyfkon-grPV8cMwQ5u7JgiRUSH5ZDLvldjycbYRYhlQcRR8zPwXRBy4xWOLaoRMQFp7I_CqBpQx_Dw9QSIOV0eBlCsNuL-lE9Y2RPUIfx3mgyWLGky1NQwj0Ze_N88t5v3qOfsUsPsFJweT3G_aCLf-zaJdkPO24_lrYwGsDxndUwxsBlHs97P3ULWN-Im-4M0tN6EBrXvQOLJfpsRG7BDT0L3snwVf6bhYxFxYVuztazRKJjY0pCiTtJyH8wyDvaD9YYqMZsOfnE7p_mdy59qbU_UrwnieUwP_e4xe6ZbkmF8c1r0-j2YOB7YgAIU-KYxqz1NCuSrg82qxlNA6DRsx-GsQxUkA4gLdM-_S3_qQAxIOURLqCWPPwUdUImltHmABDZd3SjS5LMC8JnWhfkOTTYK3gBCWSivNJicGvOPd3zXK1WXGX7ra4pYarrLfdT9ZmVgi3lEB-3bknyPq9t7tMggN3JvYwMm00Vmy5M0FzftbzFUEoqx-9NcRNnxee7HZzKor-q34fOjWQGio6BCWe_38dWsJ4OKBYZtozmaso6IM1zRU9PRAIZwSfsRroGPjDCB7lbBxgCwLaiqGrDb1bSmKANU2I8A5uljpCm9VjgUhRDPXY3p1YhNTEIlyiyYieCRIo6IF9WlA3eoRg_EWZYb7nKV599AAxVMWZ5oIR6ZU6BGpb_chrhH5R2uqi5RdLJZjPLjV6Kz1Xq6Usk_GVD-xkfabpcPQ0_JtOlGEFer4DYAqqLxzglY72l-P6xylls8oqocMAXGIq6B_b0J4-mwWviq_-CTUbmmH_lsKM3OnfgTaWJhufTV2rti82prtR9AFpFYQMCF-SdYC84WULM7wD8hW1joJWhA3LoSyN9EZLWDNdJHKykiTDhzyjCHREnB3TpniYEGf5XyU05GkW5UzXiVzBKlebTTuJGgGoa5PZWiqXgdgjriBTOtcodwn2HISumB49fDxiC1sTJD5LFewGCjDPg1jleVY5b-p3I0NnUSUnl2396DHOxxhq2VVLpmUGaEN336az9BPh6mIzdJzoHiVm7uaEbDbNV5JB1PpksNxGzq6Yhmz8L1EJBOGCdYmiN9cGI-POgm4VMddptv0isfILHcc4C6d8aaB_QeCfZ5FJ3h9nhQ0QngWfr9urG-jlGdFhpYbXDElSRu4UMRV5YudQ_a_ygeqwZC0UDyN9507nFiLASSV6XYZjdc6_u-TLWT0IACbn-b7YnGM5UV8EeHM1UP_qcP7gW0jx9MD4Wt3Km-QetwYkLLPEcTWrw4OlpMlWit7HIaqugrYG1DlXSfznUpj-sFSscOjr-f2GPSRRcDgD2yvvBiQlqPKsc25yZGX5h1BsZUUCrT3sXq9MiyHCesuUWXwbB8CSEfoO58uLS1BYvpiz5qoZ07z9WeRp8BctNbjzNCzjQ8SwNlzWuiV_LXBtxICPbQjicWk1WSHOcpRY25HNAD9cDMc63apOdTlnOSwMQRfuRBtW7oBBGBzb221LyrLVPfelo3QTKDiYEl8h7-VZU0oXZ4V9ZSUiNRGfeogKwUPSA_MsUqskESH7oqSg_cMvEPS1QIc-NSQRBbkiGLihgHm6wCtv9hqFzsK6Bz0ZqspcgUPT4445a6pL_0ZwZvYtHNQ6_u5q9oFVN4XiZH7Q-eiqWTi_vavHjWF3NTR_cFnwwf3znUuNjjJYvcjgR9-NemiL_7z4is_o0QAUhZXtoOH3lQdVv4mj8bqzBa_qslXLP7oC-vpMe5blbiq1R0np34sVypAtEFl9DJ-0hc5P0aoZ9Y3IWcWhWJ1pU9W_g&cid=CAASFeRoZFdozcE_Jb4tqbjlpROFw0nN_w&rfl=1%2Chttps%253A%252F%252Fthreatpost.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:30 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
PugMaster
image6.pubmatic.com/AdServer/ Frame FBFF 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=99071477&p=156858&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
4fab72dc8ea248c85dadc2fdf377ee56d24dc5c0a1dc87c24c1642702b8d228c

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
1811
content-type
text/html; charset=UTF-8
usermatch
ssum-sec.casalemedia.com/ Frame E925 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b6ccb89ba648d507f400b5eba43427cb03126dfa77578b3f67922a49fc61017

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://js-sec.indexww.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
241|45|230|39|46|81|156|8
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1618
Expires
Tue, 30 Nov 2021 09:08:30 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Connection
keep-alive
usermatch
ssum-sec.casalemedia.com/ Frame B9CF 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
04c093e430826ca10880992c3b7a891c7a06acbb4689a6e3f7878d7271c4e934

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://js-sec.indexww.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
39|230|241|45|57|10|195|206
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1701
Expires
Tue, 30 Nov 2021 09:08:30 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Connection
keep-alive
truncated
/ Frame B8A1 		208 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d0a193391736782d237ccd5863a121cdb6c6da890b399d92c51d537cffd83abc

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame A5DD 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Mon, 29 Nov 2021 12:44:40 GMT
expires
Tue, 29 Nov 2022 12:44:40 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
73430
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 4115 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb942ff04c67c59bbe8b9be22036327d1564b588903c99d6f598390d6013588f

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
index.html
s0.2mdn.net/10774078/1635808046742/ Frame 8E82 		15 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/10774078/1635808046742/index.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eca17adc307624155d47990253cd2372aa60b097ef0718af007616e4ae3b83e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
access-control-allow-origin
*
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length
3978
date
Mon, 29 Nov 2021 11:06:41 GMT
expires
Tue, 30 Nov 2021 11:06:41 GMT
last-modified
Mon, 01 Nov 2021 23:07:26 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
age
79309
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
view
googleads4.g.doubleclick.net/pcs/ Frame 2AD8 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuKtVVfhrXhrmHhwBVhl0TUyYYY_TEDizHhVYvqkognRKhiVcb0npHel4XyQL4GC7RymNTaMMHmHaOxHptFRxy7VlUrGs_AAAZxc_h8tBLqpiwgk-k5WprAbAKKXSzmsg&sai=AMfl-YRCyYzsCnqIqXTj0yeIvbKx8XQh3W1Fo6POFtWmr78ETWgDqO0ZxZ_1iE9AJrC6JL637rD_2oLdq4rLDf1q-e5IqG5DV2PBwAMoAdg&sig=Cg0ArKJSzHNYZt_kGSLgEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=323&cbvp=1&cstd=306&cisv=r20211111.45456&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:30 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 37C2 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Mon, 29 Nov 2021 12:44:40 GMT
expires
Tue, 29 Nov 2022 12:44:40 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
73430
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
abt
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:29 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
truncated
/ Frame 2AD8 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
921c9a3b844ff84e61b3e608d67f365c32ee705e8681cc4edcaf9b979ae99c6d

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
match
c1.adform.net/serving/cookie/ Frame D633 		35 B
467 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?party=14&cid=E461FCB8-9678-4565-B13D-1B260BE3F7B9
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 30 Nov 2021 09:08:30 GMT
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains
Pug
image2.pubmatic.com/AdServer/ Frame E28B
Redirect Chain
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1361929279369711967
42 B
210 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1361929279369711967
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Tue, 30 Nov 2021 09:08:30 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
lhrpug001:0:415
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1361929279369711967
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame FBFF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=5GH8uJZ4RWWxPRsmC-P3uQ%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:03 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3945-5c4c7cc02bd56"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=48419
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5054
expires
Tue, 30 Nov 2021 22:35:29 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame FBFF
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=f0a061a5-ea0d-4f00-a403-cf47764996bb
0
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=f0a061a5-ea0d-4f00-a403-cf47764996bb
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:29 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
MT3 4133 baa842e master zrh-pixel-x30 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=f0a061a5-ea0d-4f00-a403-cf47764996bb
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 30 Nov 2021 09:08:29 GMT
/
pixel.onaudience.com/ Frame FBFF
Redirect Chain
  • https://pixel.onaudience.com/?partner=214&mapped=E461FCB8-9678-4565-B13D-1B260BE3F7B9
  • https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25
  • https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1
  • https://pixel.onaudience.com/?partner=161&icm&cver&mapped=529534b7feba3bab8cb34c8a46e6703d
35 B
248 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=529534b7feba3bab8cb34c8a46e6703d
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
51.210.112.236 , France, ASN16276 (OVH, FR),
Reverse DNS
pikafka-1.cloudy.ovh
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-length
35
content-type
image/gif

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=529534b7feba3bab8cb34c8a46e6703d
cache-control
no-cache
access-control-allow-credentials
true
content-type
text/html
content-length
0
Pug
image2.pubmatic.com/AdServer/ Frame FBFF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RTQ2MUZDQjgtOTY3OC00NTY1LUIxM0QtMUIyNjBCRTNGN0I5&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug002:0:691
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame FBFF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKuL86I8gGE-ASYitiQTKYc&google_cver=1
42 B
361 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKuL86I8gGE-ASYitiQTKYc&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug011:0:2505
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKuL86I8gGE-ASYitiQTKYc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame FBFF 		43 B
616 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.122.14.34 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
22.0e.7a9f.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Mon, 29 Nov 2021 09:08:30 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame FBFF
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
42 B
650 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
no-store, no-cache, private
x-lat
amspug014:0:378
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
MT3 4133 baa842e master zrh-pixel-x10 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 30 Nov 2021 09:08:29 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame FBFF
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=834006166056631821
42 B
388 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=834006166056631821
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:29 GMT
cache-control
no-store, no-cache, private
x-lat
amspug020:0:578
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=834006166056631821
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
si
googleads.g.doubleclick.net/pagead/drt/ Frame 8A2B
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: 3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
URL: https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Tue, 30 Nov 2021 09:08:30 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Tue, 30 Nov 2021 09:08:30 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
dcm
s.amazon-adsystem.com/ Frame E925
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
43 B
645 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
7WDEHZGHRSTKCG9VB31J
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
N50RA6XN484YXY7CFT2A
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame E925
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YaXqDmdMgARsAxdRjdxjjQAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
43 B
1011 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
325
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame E925
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&gdpr_consent=&us_privacy=&gdpr=1
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame E925 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
getuid
secure.adnxs.com/ Frame E925 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
rum
dsum-sec.casalemedia.com/ Frame E925
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&gdpr=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=Tbc5Ux7naF9W4z5XH7V1Vhm_aF9Wtm1WTb8RVkwy
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=Tbc5Ux7naF9W4z5XH7V1Vhm_aF9Wtm1WTb8RVkwy
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=1&external_user_id=Tbc5Ux7naF9W4z5XH7V1Vhm_aF9Wtm1WTb8RVkwy
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
cookiesync
bttrack.com/pixel/ Frame E925 		35 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS
46.bidtellect.com
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

X-ServerName
Track004-dc3
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:29 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
crum
dsum-sec.casalemedia.com/ Frame E925
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/ix.gif
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:31 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
date
Tue, 30 Nov 2021 09:08:31 GMT
server
Kestrel
content-length
0
htw-pixel.gif
js-sec.indexww.com/ht/ Frame E925 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?YaXqDmdMgARsAxdRjdxjjQAA%261821
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:30 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=1369
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:31:19 GMT
casale
match.adsrvr.org/track/cmf/ Frame B9CF 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usermatchredir
ssum-sec.casalemedia.com/ Frame B9CF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&gdpr_consent=&us_privacy=&gdpr=1
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame B9CF
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
43 B
645 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
TVN3RY1KDKMF2ASQ8HGA
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
TYXTN9QBSDBE07GJTEQY
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame B9CF
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YaXqDmdMgARsAxdRjdxjjQAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:31 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEMSTiDBVR0l1oRI6kAMFh0M&google_cver=1&gdpr=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
325
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame B9CF
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=2079&gdpr=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5142336718970418140
43 B
1003 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5142336718970418140
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5142336718970418140
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
crum
dsum-sec.casalemedia.com/ Frame B9CF
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=8
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=626567909448
43 B
984 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=626567909448
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:30 GMT

Redirect headers

access-control-allow-origin
*
content-length
0
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=626567909448
crum
dsum-sec.casalemedia.com/ Frame B9CF
Redirect Chain
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-99c6a6b4-33e7-474a-8ca7-31ce588ad3f8
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-99c6a6b4-33e7-474a-8ca7-31ce588ad3f8
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:31 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-99c6a6b4-33e7-474a-8ca7-31ce588ad3f8
date
Tue, 30 Nov 2021 09:08:31 GMT
server
Apache-Coyote/1.1
content-length
0
sync
ups.analytics.yahoo.com/ups/55940/ Frame B9CF 		0
15 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&gdpr_consent=&us_privacy=&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
htw-pixel.gif
js-sec.indexww.com/ht/ Frame B9CF 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?YaXqDmdMgARsAxdRjdxjjQAA%261821
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:30 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=1369
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:31:19 GMT
be68fac4543e50759c26d7a153fea00f.js
s0.2mdn.net/10774078/1635808046742/ Frame 8E82 		65 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/10774078/1635808046742/be68fac4543e50759c26d7a153fea00f.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8d4b9633320f23d8ce3c4dcb514f76d27c6774115c5f699917dd94c3777a6ba7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 12:17:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75038
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17238
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:27 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 12:17:52 GMT
lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
pagead2.googlesyndication.com/bg/ Frame 6B6B 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 21:45:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
41000
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13508
x-xss-protection
0
last-modified
Mon, 08 Nov 2021 11:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 29 Nov 2022 21:45:10 GMT
lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
pagead2.googlesyndication.com/bg/ Frame A5DD 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 21:45:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
41000
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13508
x-xss-protection
0
last-modified
Mon, 08 Nov 2021 11:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 29 Nov 2022 21:45:10 GMT
lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
pagead2.googlesyndication.com/bg/ Frame 37C2 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 21:45:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
41000
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13508
x-xss-protection
0
last-modified
Mon, 08 Nov 2021 11:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 29 Nov 2022 21:45:10 GMT
JS-60007,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:eyJldCI6MS4wMTl9
pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3E... Frame 1A0D 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA/JS-60007,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:eyJldCI6MS4wMTl9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
JS-60005,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3E... Frame 1A0D 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA/JS-60005,rb:Chrome96,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
JS-60003,rb:Chrome96,rm:mp4,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:eyJldCI6MC4wMDJ9
pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3E... Frame 1A0D 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA/JS-60003,rb:Chrome96,rm:mp4,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:eyJldCI6MC4wMDJ9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lX...
pr.ybp.yahoo.com/eng/2/imp/ Frame 1A0D 		0
126 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/eng/2/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:30 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
7b77dcb1ba552ce7a99facfd1a9090e3.png
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		410 KB
410 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/7b77dcb1ba552ce7a99facfd1a9090e3.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
807e17c9876120eae3192a036a1d509cb5c3094de970d7a30b83e9aaa0b90aed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 11:06:41 GMT
x-content-type-options
nosniff
age
79309
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
419488
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:27 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 11:06:41 GMT
e215778eb1829fe5ae0df4333ecc3af2.svg
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		4 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/e215778eb1829fe5ae0df4333ecc3af2.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
96d9f58640c821cd2bc50aef63eb8f804d74c7fc9d38adccac99131affaa5eda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 11:37:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77435
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1310
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:27 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 11:37:55 GMT
aa7bff99dfc4debf28604cbab4feb145.svg
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		5 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/aa7bff99dfc4debf28604cbab4feb145.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f68329f0d0fd84eb7dd073b8c297c1c5ecd584db4bb6e02eb50aaf7a5c440f3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 12:17:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75038
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1419
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 12:17:52 GMT
625949717608adec9ba8fc401f1dd414.svg
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		3 KB
989 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/625949717608adec9ba8fc401f1dd414.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c1fbf6716f852b0885fd2e921f0b1e5f2c8dd57e3fde17c297ba81f0fc77427
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 11:06:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
79309
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
963
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 11:06:41 GMT
56032aa32d9d4ef3e010aea88f1d5baf.svg
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/56032aa32d9d4ef3e010aea88f1d5baf.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3a3fdb1f3bf800e3d6388a16866c63cfa164ed6f85823cfc3a726b785993e10c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 11:37:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77435
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1008
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 11:37:55 GMT
d99f8f19ea5c8d931e96d24fa4363ad7.svg
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		1 KB
713 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/d99f8f19ea5c8d931e96d24fa4363ad7.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
63c6baa33b668706ab50772748de9ae03e8d88b691a4e71c6dd656f203b860ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 11:14:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
78812
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
687
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 11:14:58 GMT
58ce29676158a040ceff3399e42ae7a2.svg
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		1 KB
606 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/58ce29676158a040ceff3399e42ae7a2.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9f0996ed0067396fee7b71b5b4c8b264f2c7edefa6cce07431184ae931c542e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 12:17:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75038
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
580
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 12:17:52 GMT
4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg
s0.2mdn.net/10774078/1635808046742/media/ Frame 8E82 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/10774078/1635808046742/media/4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1635808046742/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9fc98a5f2ad3fade2176c7f4d057c02a332ee5d3e532746414eda6e88bc46ae5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://s0.2mdn.net/10774078/1635808046742/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 11:24:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
78270
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1881
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 23:07:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 30 Nov 2021 11:24:00 GMT
pixel.gif
yahoovpaidtwoint215831825037.s.moatpixel.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yahoovpaidtwoint215831825037.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=56&gmv=0&fvt=56&apd=972&h=0&th=-1&bfa=1&d=threatpost.com&sp=0&L1id=Yahoo!&L2id=347687&L3id=1799672&L4id=3651557&S1id=55&S2id=0&ord=1638263309391&r=541895839812&t=meas&zMoatAuctionID=1362287899579984651:1638263305966&zMoatAdReqDomain=threatpost.com&avoc=0&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&w=400&ht=225&dh=0&q=1&BSD=unsafe&BSC=moat_unsafe,gv_crime,gs_business,gs_tech_computing,gs_tech&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Tue, 30 Nov 2021 09:08:30 GMT
pixel.gif
yahoovpaidtwoint215831825037.s.moatpixel.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yahoovpaidtwoint215831825037.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=56&gmv=0&fvt=56&apd=972&h=0&th=-1&bfa=1&d=threatpost.com&sp=0&L1id=Yahoo!&L2id=347687&L3id=1799672&L4id=3651557&S1id=55&S2id=0&ord=1638263309391&r=541895839812&t=nht&zMoatAuctionID=1362287899579984651:1638263305966&zMoatAdReqDomain=threatpost.com&avoc=0&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&w=400&ht=225&dh=0&q=2&BSD=unsafe&BSC=moat_unsafe,gv_crime,gs_business,gs_tech_computing,gs_tech&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Tue, 30 Nov 2021 09:08:30 GMT
pixel.gif
yahoovpaidtwoint215831825037.s.moatpixel.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yahoovpaidtwoint215831825037.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=56&gmv=0&fvt=56&apd=972&h=0&th=-1&bfa=1&d=threatpost.com&sp=0&L1id=Yahoo!&L2id=347687&L3id=1799672&L4id=3651557&S1id=55&S2id=0&ord=1638263309391&r=541895839812&t=bs&zMoatAuctionID=1362287899579984651:1638263305966&zMoatAdReqDomain=threatpost.com&avoc=0&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&w=400&ht=225&dh=0&q=3&BSD=unsafe&BSC=moat_unsafe,gv_crime,gs_business,gs_tech_computing,gs_tech&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Tue, 30 Nov 2021 09:08:30 GMT
pixel.gif
yahoovpaidtwoint215831825037.s.moatpixel.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yahoovpaidtwoint215831825037.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=56&gmv=0&fvt=56&apd=972&h=0&th=-1&bfa=1&d=threatpost.com&sp=0&L1id=Yahoo!&L2id=347687&L3id=1799672&L4id=3651557&S1id=55&S2id=0&ord=1638263309391&r=541895839812&t=hdn&zMoatAuctionID=1362287899579984651:1638263305966&zMoatAdReqDomain=threatpost.com&avoc=0&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&w=400&ht=225&dh=0&q=4&BSD=unsafe&BSC=moat_unsafe,gv_crime,gs_business,gs_tech_computing,gs_tech&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Tue, 30 Nov 2021 09:08:30 GMT
integrator.js
adservice.google.com/adsid/ Frame 42CC 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 2AD8 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuKtVVfhrXhrmHhwBVhl0TUyYYY_TEDizHhVYvqkognRKhiVcb0npHel4XyQL4GC7RymNTaMMHmHaOxHptFRxy7VlUrGs_AAAZxc_h8tBLqpiwgk-k5WprAbAKKXSzmsg&sai=AMfl-YRCyYzsCnqIqXTj0yeIvbKx8XQh3W1Fo6POFtWmr78ETWgDqO0ZxZ_1iE9AJrC6JL637rD_2oLdq4rLDf1q-e5IqG5DV2PBwAMoAdg&sig=Cg0ArKJSzHNYZt_kGSLgEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=857&vt=11&dtpt=534&dett=3&cstd=306&cisv=r20211111.45456&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
nop
ib.adnxs.com/ Frame E7CB 		0
733 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/nop
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
ff285f6d-f24f-43d8-895e-c2969371e520
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lX...
pr.ybp.yahoo.com/eng/1/imp/ Frame 1A0D 		0
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/eng/1/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 1A0D 		0
23 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvL1F1QBHh54UzPTFsWpylOWyDLNa-tuBCLrcGMUXy1BL9pu7zbXKJczAAiHrKxX1zb_0tLmUq-gtclyyMcE8Kw6LOYi2IYUMGH1dG605Kj82EXjrVv8IVmGQag&sig=Cg0ArKJSzOjMBIdoCquVEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
JS-60001,rb:Chrome96,rm:mp4,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3E... Frame 1A0D 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/vasterror/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA/JS-60001,rb:Chrome96,rm:mp4,vv:2.1.59,pu:https_%E2%81%84%E2%81%84threatpost.com%E2%81%84ikea-email-reply-chain-attack%E2%81%84176625%E2%81%84,dm:e30=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lX...
pr.ybp.yahoo.com/eng/3/imp/ Frame 1A0D 		0
30 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/eng/3/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
dc_oe=ChMI3puAtN6_9AIVfOq7CB2OPQO8EAAYACCUvoVI;met=1;ecn1=1;etm1=0;eid1=11;
ade.googlesyndication.com/ddm/activity/ Frame 1A0D 		42 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI3puAtN6_9AIVfOq7CB2OPQO8EAAYACCUvoVI;met=1;ecn1=1;etm1=0;eid1=11;
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
pubads.g.doubleclick.net/gampad/ Frame DED0 		156 B
142 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pubads.g.doubleclick.net/gampad/ads?iu=%2F107430338%2FCNXORTEST%2F2570&description_url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=1995660511924269&cust_params=domains%3Dthreatpost.com&ad_type=video&us_privacy=1---&sdkv=h.3.489.0&osd=2&frm=1&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=4002501869&sdk_apis=2%2C8&sid=398C6587-BAA3-4BBF-8F9A-CCF68F1E0DA5&nel=1&eid=44752711&top=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&loc=about%3Ablank&dlt=1638263303392&idt=2361&dt=1638263310571&cookie=ID%3D6f96e43cee95e30f-22f8a5cb16cc0003%3AT%3D1638263306%3AS%3DALNI_MaMMsvstGLA9EgC28AYfeQhtwgXjQ&scor=3652044256968201&ged=ve4_td8_tt5_pd8_la8000_er1007.1246.1166.1552_vi0.0.1200.1600_vp100_eb24171
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.489.0_en.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
cafe /
Resource Hash
8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://imasdk.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
113
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/xml; charset=UTF-8
access-control-allow-origin
https://imasdk.googleapis.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ai
capi.connatix.com/tr/ Frame 42CC 		2 B
246 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ai?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
37aa3970b6801c9d286464f7d86e50bf41c88e54c7b4d08f3ff61935b3f59c3c

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:30 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
2
content-type
multipart/form-data
v2
ams1-ib.adnxs.com/vast_track/ Frame 42CC 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams1-ib.adnxs.com/vast_track/v2?info=agAAAAMArgAFAQkK6qVhAAAAABFN2FLvE44pehkJ6qVhAAAAACCU5e6SASgAMJ8XOOc3QMyyYUjD6pcCUJ-ZpQhYvY0HYgJHQmgBcAF4AIABAogBAZABkAOYAeEBoAEAqAGU5e6SAbABAQ..&s=7c5eb20315d533ef6dec8ea58f0da25caec2c6b6&event_type=1&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
a9f05ca8-52e1-4cd2-aa9d-571aa8791aca
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
it
ams1-ib.adnxs.com/ Frame 42CC 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QKEBeiEAgAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9yOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SBCn2DSTYMQAAAOB6FP4_MJ-ZpQg45zdAnxdItwFQlOXukgFYy496YABo56WpAXiykAWAAQGKAQNVU0SSAQEG9P0BmAEBoAEBqAEBsAEAuAEDwAEFyAEC0AEA2AEA4AEA8AEA2ALTR-AC1_c36gI8aHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9pa2VhLWVtYWlsLXJlcGx5LWNoYWluLWF0dGFjay8xNzY2MjUvgAMAiAMBkAMAmAMXoAMBqgNNEhMxMzYyMjg3ODk5NTc5OTg0NjUxGhM4ODAyNzIzMTYyOTQzMDUxODUzIgkzMDc5OTkzODAqDU9BVEgxMDE3MDAwMDA6BzM2NTE1NTfAA-CoAcgDANgDttW3AeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA44OS4yMzguMTQyLjIxNagEALIEEAgBEAQYkAMg4QEoAjAAOAO4BADABADIBADaBAIIAeAEAPAElOXukgGIBQGYBQCgBe6n3aHft5OpH8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBb2NB_oFBAgAEACQBgGYBgC4BgDBBgAAAAAAAPA_0AbkvwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYE8gYCCACABwGIBwCgB0CqBwcxNzk5NjcyugcPCAAQABgAIAAwADiiCkAAyAeykAXSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB8PWZIoIAhAA&s=de97a5fef085bab049507b0190a0c90711493637&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
221e5284-86b8-469a-a834-a969723715e4
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
1_th.jpg
img.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/60764267-557e-410f-85cb-f102d92ee134/7f094ac1-0249-4680-8dd4-43881d0d0457/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6daa27fedbf78fddf32e3fdfada60642a83bb9b1bf4eb996e71f2010a9dd3861

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-encoding
br
age
1026408
etag
"SxSWjca7k4nctj/h0NXUCMaqKQ/LM66C1zSukVtV8PA"
access-control-max-age
86400
fastly-io-info
ifsz=76994 idim=2560x1440 ifmt=jpeg ofsz=7623 odim=400x225 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7187
trk.js
cdn.adnxs.com/v/video/221/ 		118 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/video/221/trk.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
4f5400d92abbf35b83ec1d310f710359807f149972ab1d541372def9cce9073a

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Content-Encoding
gzip
Age
2416161
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
36894
X-Served-By
cache-lga21952-LGA, cache-lcy19225-LCY
Access-Control-Allow-Origin
*, *
Last-Modified
Tue, 02 Nov 2021 09:57:10 GMT
Server
AkamaiNetStorage
X-Timer
S1638263311.364954,VS0,VE0
ETag
"1fd88994727f2e8627644b070089627e:1635847030.145943"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Via
1.1 varnish, 1.1 varnish
Expires
Wed, 02 Nov 2022 09:59:10 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
1, 250937
adchoices.png
s.yimg.com/ff/adchoices/icons/ Frame E7CB 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.yimg.com/ff/adchoices/icons/adchoices.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e02dccb1f7be4cd317a35d9931a57accaf6ae679bd70925fced8758c8a5d8d9e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 08:59:26 GMT
x-amz-meta-created-date
Wed, 28 Feb 2018 23:01:51 GMT
age
546
x-amz-server-side-encryption
AES256
x-amz-meta-x-ysws-mbst-vtime
1519858911956637
strict-transport-security
max-age=15552000
x-amz-request-id
JMYJMVMVM57ATM7V
x-amz-id-2
6bhxH3tjmYbDWjuA+w13mOUBuhFQ4ibI6ONV7MdabcDiERh7raDnIJ/9ZOHIH3sOYgn6kLTMCK0=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 16 Jun 2018 04:28:24 GMT
server
ATS
etag
"b35443e8fa8019356b8c1cac9a13b405"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary
Origin
x-amz-version-id
null
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
public,max-age=600,stale-while-revalidate=30
content-length
4079
content-type
application/octet-stream
x-amz-meta-x-ysws-access
public
x-amz-meta-mbst-etag
"YM:1:5d9fa95a-42cf-4830-8546-67ded15775d80005664dba8e4e9d"
x-content-type-options
nosniff
expires
Sat, 16 Jun 2018 04:38:23 GMT
jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lX...
pr.ybp.yahoo.com/eng/14/imp/ Frame E7CB 		0
21 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/eng/14/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame A5DD 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BAA89DeqlYbH1HvnMx_AP2sG4mA8AAAAAOAHgBAI&bg=!qKulq-_NAAZQLpa_UC47ACkAdvg8WvixOylTHiT2e7XyGrnCGZvqfRSEuQcxsS5d_etbIoFHxqx2oAIAAAGPUgAAAA1oAQeZAsygIkhKpN16tyj0zyBJ6aCkqR9iEJhJTxUDjCXsVsdYmi0bhlydvjlS5BJ0X452mzFjeWyOmEjORVYEby4coYQZzCJPNHYVIjGq9zauyjguQJDEIZA9vuN-kvqQjfyccIGeBNo2nOw73XXQlsVmB0nQeOHZOwR24lmFMAsSTkEEoWrrfKbk2SSD-SKqCxs2MD7E6adYJpHX8u3pxOvdG_HXXe4mucBpN1gybE7_1GoJPVK0nnOeCZzEUNUswy6DYHz3Nm1yeyOxWiaJyfOWF1IMVUNJGiJRdh6_NZqApMNKb260CiDJtHD219PluFcpAnoulPkwEcnPMVFKY1v15zQvD6QokDgtkNw-rJ07r0JxiJsshkO9GNsR4YL_594su2PaEmipWNJGg7cgrFGYuOhgL-423fmRemGM7dPRSmd5hXNf30HehNGPb55iVfxsMCx_4dEuoiDGLDrkbw9mRBrFDAdM1qkgFLZafeZbaK2bnUy-E2cVZe5_ooACWVAhD2gsUOOhOGdGlQooZ_LoYIOV4RVZn7QWAx3iaK8M7Z6hPsDtAcK9UcFqMYkFNCVQD2JFirD3Se8kFiBr7E6im_-J6GTYQtt0Vje9TjArt7KOyj2REG5iiENnJoQjPl_gZnTsI-ISCD44zFnts6VA-1ew8G_FnrJKhb2BzOuxmB0c1cln4lkfKMUbt7fVQJedBRJ2kgCos1DzCBIbW2VFG9QIser5bV-qI0JZTLej8rKCO22Gj_rqO89sae60SeSMXvOQ4zhroRv-RBeXig5drT8kE9FmVVT2ZW-NTNJwLsUh6JBTJhh0A5He_EQibJ4lBRu53s5ir0sR9FuOymmVw42TArrVvUZkX9Euv3GDejCsOukBg2wxIAl2vDNgClTwt1mNqwLpOy3xu6CX81Twan-uMkj4fQlWKf2FP9KlLuVYrEKsgmpLXS5qSDjvHg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 6B6B 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BtJvBDOqlYfLeOcDb7_UPx6ep2AkAAAAAOAHgBAI&bg=!aWqlai7NAAZQLpa_UC47ACkAdvg8Wo3ijqu7IuzXizC8ag2eKZgVc_AYhwdfuP070T3CDVjFi3z0GwIAAAGuUgAAAA5oAQeZAs9_IrTsIyWq0grfm0iYln_oUm6vCsIPEugEz2OaXlZSIcQgPfzpUx9s0NaLNgiUFOou6A-Clh0UOEZ0a4lgLQ1fMEqmBUwmOvzsVYedvB9M7aK6ibzQTxere9s0rorWagTuQMYY6gWhNFLPsWmT-VGs9AWujiGXzCra9HEIfOIjWSAiMPBMs9kATL5pMoKqeP8a0JMzxP1FdjZQ5t556lzfmpNU5P1L7tmh07uSNRkgBlGUXr3knqoeRbU7ccmo7tWoZHLwXaqHeBb4Ib4kY9kieuo1U304uP3lrf26qDk11UfxkefR-AyiNSkIWRWk6usq0YrVbohFYfl1IzFR_xHx3Q3Q5aXJpThN7fTTu8RrqMk8Pws_pFynvOkiFaLCq9knW22jXSFn-uzwf_JExmMINCmSFZ2SxORfgShCw8tItstWBFwtQEBCGz8SgY7kyLa-S4oi3yuODCX1lU9HTWMWD8UzPCFc_ExgrvXMf_67ffar3SDxlp37UVDBu9XnbEs1OQLmECRliTY_-KftvvcjdbaxuiQLJA8d_qayZgdMF9JazMK9sEUzX4Mzi-7UKUXvJZPbRSH9EjeCO5kWTw5MNpvByyPWzCUa_GgH5a0VXqJGEFK5tZstyGSruV-RjzmTTjANJy5VaMgDMmVPaWs638tjI5qnqFuWaLb8Hb97Q_A1BgKBnZ_7XtJrLwoN89JLzSOOxFoXhYIokQ-hczgAjPAWCJBGx5_-GPQmSN9jbIjfDi0bI_rjFNi-B6KbA56Vj2B3mbGOQ8UxzVlzSlinNBOBZQAMcyGfgC7IIjOLzcob2eFJ-xBv63AWFDG0tMhog-LlB4dqGkRsnltyrEcHuJYuCIkIlBMmepspAx3O_X6jaITHq6CveYUBthkBhChSlhQoHDIOcogIGR4MFb4vhRbjpyzH2PFsVUoImsS3tE3NxCaG8u6B6ZhYUF-i_w
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
v2
ams1-ib.adnxs.com/vast_track/ Frame 42CC 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams1-ib.adnxs.com/vast_track/v2?info=agAAAAMArgAFAQkK6qVhAAAAABFN2FLvE44pehkJ6qVhAAAAACCU5e6SASgAMJ8XOOc3QMyyYUjD6pcCUJ-ZpQhYvY0HYgJHQmgBcAF4AIABAogBAZABkAOYAeEBoAEAqAGU5e6SAbABAQ..&s=7c5eb20315d533ef6dec8ea58f0da25caec2c6b6&event_type=2&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
fbdf3718-1edd-4725-9d01-2dfe70440d5a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 37C2 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BzMQMDeqlYaS6DY_y3wOosDMAAAAAOAHgBAI&bg=!4eKl4qbNAAZQLpa_UC47ACkAdvg8WqJRBkvb9sYr_qo38xkxSWXhTwNF9XcjziWhF3dskcuAy7gFxgIAAAFvUgAAABVoAQcKAAfTtY84ZHaJmQLBfSAruq0YMkDRu1T9j8GwymwPa_hMMRT0XJGP_5STaTfrYdpBqGLlxSNnRrtrjrL9wEtaIc0ey3dlbOFS0pWaP5TnBI2-9q5C-a3yLOcUfNT8euQ8PpYWbWcNd0_bHVLWZqFlP5HeJVYMYx4vJ7OOE_UNoi_X3Ht_UKx35xLrMmeyvelHAGZd4DGzqg4aHRq_XDdBtNKQmXAGOzTzp5WR-lxKPHE4n9jy8c87_hZqMfMga-cWAh6EEkXnzMRY2UjBcobf5O5W-w0fiQ-WAPLxN05hSpCjVhqCgSPNOUlDzXQShX4bTOSMUAW1rL_5lCtYSKpfuCx3O9WAB485xnQQjlCjcFsJMdfbp8NLD_8VWR7VYCOtm5Zt5L7_Me4z9zNQrJ156_LbSRJVWezVQrNdd1HIlirllwLISuEpFw_P4C5HzU3nzC6u_X5ynPMeVAWiteQFKg-BFCQ2OPkUtnzOxN0RcSUh95Nbv2HqCdF-NQDvsRF9cvxTi38gkjBjdHaktD0mGeEnv7WXq7gf5PPlYlpyvuMrWnp1Svv6rMurIo2i-2HNO2fEXEcJ2aekYD2rATrSA9kHksbWOj7bj08tAff4Rpi2tzhbT0Olk4EabmHVLo6ZnZu2UrKA1d0hd6G-bxirzUNpuH-f0WCtM6wyVhZ9YJAkkPfYL-ufS-HusX1o3X5Ru6ehl0b829juceAp72f8Au3SWHoJdBwsHZTts9natWbwBUe30q8HFcoR4WQ1SmPJhvbeQoZHQsd1TcR_QnRQAMpOA1idt4RHTrkGrK8f5L2Yvl6_vD_gIzPa6X6bc_3ZPl3k1nPlybXhImWv52oda4Wx5k82KTd4nNNJgadLtVsfhmid6QNwYZg_KlTomwOuZ2qlxKbuO0sOrsXpth16pwuAFm5R3rugyXdutWC4oBOyjK8jxqDYw9asyAzI
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 1AA3 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
898ba5de-0a60-4953-a636-a2be08b3e7a9
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 55BE 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
c9cbbe9c-9282-481d-b731-c285a51bc3e0
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rd_log
ams1-ib.adnxs.com/ 		0
826 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://ams1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QK-Eei-CAAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9yOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SBCn2DSTYMQAAAOB6FP4_MJ-ZpQg45zdAnxdItwFQlOXukgFYy496YABo56WpAXiykAWAAQGKAQNVU0SSAQEG9DcImAEBoAEBqAEBsAEAuAEDwAEFyAEC0AEA2AEA4AEA8AEA2ALTR-AC1_c36gI8aHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9pa2VhLWVtYWlsLXJlcGx5LWNoYWluLWF0dGFjay8xNzY2MjUv8gKDDQoISU1QX0RBVEES9gxoQjFUaFpjRy1KUTdJSnNWdmlLOU5HcWp0T05vYUdmdU9oTkpISlRzMmhCV19JRHZjRDdzenUzaUVMNHI1eVF3Q3R0eGZfVkwtYzRPeW95TWMtamRlcmdRMV9iMWVxSUtCZnFERVZNbmJQZkIxY29MVkQ4Szh5bEtXaWllbDF5SHZsV3RGTURDdTV5WkZQSGg3T2hGXzhNbTRtRnZPbUNkdC1BV3R1WFk4Rko2emFnSDAyNGFUQnhHbGJoWlkweEtETzYwd0FEbFJQUFNldnNyNEJWR2pMdHpXaWQtR2poU0cycGFzQmpZb0FaVlJuNlRuSG5IMWdyUWx5QXN0VnZ5bWxTSm5LRFo4MVNWRkNqWkRuY3VfZVpPdE5nLWtQZVlJV1BHYTE5cXM3VWFWNFgyUGF3V2hEZkh4Q0drODVrZk9ybk5uRnFuQ0l4WXZhN2NZMEZ3S1FYOERBSkNZQUpDNmdVMXVTdGZ5LXp1RUNmWmxzQUdBdlAyRlFvMGs4V1VrSUgxMVFRTmFYVElGUmptUWxYVC05cUcyUThXT1RwVUg2cDZIYUNkMjRRQ1BySVhQZ2twdmQzUThrU3RFVG9tbS1GN2R6ZU1FNDFrUnhpdHRrTmRMcnlaU2E1YzNiT1Jjc3lEc0hJN25XaFlZYVR1eWFieHFYSlFyMXg0VXdId3BCaFdUbk80eEJyMV9tdTBQX3JsZkVaaGZnWUJEQ3hWVFZNU0JuSzFsM05wWHRzX1lhNi1kanExdHkzSEhEZ2tvcUlieEZJVW82Q25zMmdncEYxVlpwbjJ3YldxXy1Gdl93Wmxlc2s1ZmNqWHJDMGswT0FnVjRMU0ZndlN5blFDMlRYb2lwLXlRMkJFQTc3aHRfRnVsb3RURUdQLUhtZlE0OUtEME5ZcHY5TkQwV0dmSTdpMGdJVlVXalp4WU42Vkp0WkxSc2hyaVFCay1SRi1NSmVEa3B1eGNtcW1HMmlUbW56QUMxeERsaUNsUnA1dzlaTTZXRTQ5cktOODMybk5FYnBhYkszNFhEYV80eWN4UnZSYU5hOE9KazZSaTVOMV9tTWo0ZmVVQl9nZzZpYkNyVWxqUEplMHZXMndsa2RzMS1NTjVYcWhMSDBjM1JGcmZ2c2s2X19mNUc3QWJ6emFPLU14TEVIeDNhNE5Ta2M5cVZCb01YcjF2MmRYYlhlbDdNcThSWmVxdDJ6NnZick9xSzdVazdYWnd0M2ZqTDdLNWYxMlJ1WFZIY0RGdGdnSTFQVVFhU1Fob19NaXdJRnZKS3hxVHhUY0RxVWNUVER6cjlHTGJNVjZrSnBuM1gtemk1TkR2UEZsWWlzNjlGaVd5aXo1RXVBeVVIZkdOMjFMeERuSm43X3R2Vm9fMS1vT3oyalMyR19vOTFzeW80c3lmZXFtR1MxaDNWRlhhbUx2eGl3MjRudTE1YnlBMXhfSEZQYVlqMjhha1lfazI1Tkhqbi13N1RtZXZKUHh0UUJhcDJVQTlma1pmZV9saHFfYlJ3LTQ1a0RyV3hsaHlEMEtwcVQtNGt2bFl6akMyb1UwZFBFU1lWR1doQjNGb2k3akhIMUZDeElNcEZEODZSeE9GUGlIbjktbW9XQl80TTl1dHo5b0dRMGxTNVJqSDUyVHNpRFBnZ0NGYkRWM0dyczltX0k2RFJhbW1xMjNONzI0a2RNaTMzb0pzUGZwLVNWaS1sOVBWLWxpdHV0T29uLVlQRWctdWZLS21qOGtUNlFySm5zbWpIN05aUFVZcHludTBHeHM3aXBtUXJHT1NrZ3F0cjIxOXA0bmJ6dktCWENzQjg0aHhBb2xzRXdNZmxfQUxZRXhZTW5NU1lmc3lqbmVUdVhmUnZ0TFprQVRjTzNVTWlyWFZwY2lDTUR5OXdOeTNlc0x4TDc3bUFsY2ZBdmFqbzE4QTZNVjA5aWJuRUQ0Q0VMWHAtRkhUN2o1MXBvRUt4bFdIcUR1aG8wZk15TGVla1hvbmNqa2p6NU1IWHdFdUs3al92cF9VQ2o0dEhjWk5WX0k0b0gyZE5ySlVYaFNCMGttb3JsVWdzRFBsTG5KMGhzNjRmN3VnYi1Oa29YdEhJQkRGeUlDajM3RTdLTmlhOTJnRDdVLWl6ZnNJdms0QXVCekhlQzNuUzh5SVR1WkF3TDlCM3UteEZwMDVQWDVYazdTdFRlZS03WkdYcWVMWmp0SXl3gAMAiAMBkAMAmAMXoAMBqgMAwAPgqAHIAwDYA7bVtwHgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOODkuMjM4LjE0Mi4yMTWoBACyBBAIARAEGJADIOEBKAIwADgDuAQAwAQAyAQA2gQCCAHgBADwBJTl7pIBiAUBmAUAoAXup92h37eTqR_ABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AW9jQf6BQQIABAAkAYBmAYAuAYAwQYAAAAAAADwP9AG5L8B2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGBPIGAggAgAcBiAcAoAdAqgcHMTc5OTY3MroHDwgAEAAYACAAMAA4ogpAAMgHspAF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfD1mSKCAIQAA..&s=fa685fbcae63ef868b510ac3aa714fb98ed4c903&bdref=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&bdtop=true&bdifs=0&bstk=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/video/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
a583c578-1880-428c-81f8-e247274a8cdc
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
vevent
ams1-ib.adnxs.com/ 		0
826 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QKEBeiEAgAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9yOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SBCn2DSTYMQAAAOB6FP4_MJ-ZpQg45zdAnxdItwFQlOXukgFYy496YABo56WpAXiykAWAAQGKAQNVU0SSAQEG9P0BmAEBoAEBqAEBsAEAuAEDwAEFyAEC0AEA2AEA4AEA8AEA2ALTR-AC1_c36gI8aHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9pa2VhLWVtYWlsLXJlcGx5LWNoYWluLWF0dGFjay8xNzY2MjUvgAMAiAMBkAMAmAMXoAMBqgNNEhMxMzYyMjg3ODk5NTc5OTg0NjUxGhM4ODAyNzIzMTYyOTQzMDUxODUzIgkzMDc5OTkzODAqDU9BVEgxMDE3MDAwMDA6BzM2NTE1NTfAA-CoAcgDANgDttW3AeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA44OS4yMzguMTQyLjIxNagEALIEEAgBEAQYkAMg4QEoAjAAOAO4BADABADIBADaBAIIAeAEAPAElOXukgGIBQGYBQCgBe6n3aHft5OpH8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBb2NB_oFBAgAEACQBgGYBgC4BgDBBgAAAAAAAPA_0AbkvwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYE8gYCCACABwGIBwCgB0CqBwcxNzk5NjcyugcPCAAQABgAIAAwADiiCkAAyAeykAXSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB8PWZIoIAhAA&s=de97a5fef085bab049507b0190a0c90711493637&type=nv&nvt=5&jm=1320|1003&px=0&py=974&bw=400&bh=225&sid=7737516261924475700&vd=ct~0|rr~0&sv=221&tv=vh2-132&ua=chrome52&pl=win&x=video&sw=1600&sh=1200&pw=1600&ph=7777&ww=1600&wh=1200&cd=25&ft=0
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/video/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
1ed3d1ae-8fc5-4c3c-8b41-b8f87eaa6ead
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame B8A1 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstyBwaelwLV0kmVRG8JRWDGBpQfHHX1IqKf1oLbDHWFJh6ZCEN8W46pN7_LOWGuMyKF8TlvVFXahVSTwES4AsdbT9cFxYnG50b_s6QKRi98_g62UNc&sai=AMfl-YSG6eJNi5eFSR9W8yhxNuxf7Z67x9Ks3JqlztJtX0txVnF1XrZFo1nUP_a0-7twxOUajHlmLxGHKD9NK9plqanW4YsSlXtHRaek-n5aGt94MizyfZzjgtj2gd6itPY&sig=Cg0ArKJSzB-vWJZUWH0GEAE&cid=CAASFeRoS7rBtuil-pemNiC-iCblafGFHw&id=lidar2&mcvt=1015&p=8,315,262,1285&mtos=0,1015,1015,1015,1015&tos=0,1015,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=4166723991&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638263306569&rpt=3303&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 3D5A
Redirect Chain
  • https://sync.serverbid.com/ss/2000891.html
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Connection
Keep-Alive
Cache-Control
max-age=27795
Content-Length
4947
Content-Type
text/html
Last-Modified
Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges
bytes
etag
"1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id
tx0000000000000060a14bc-0061a5051d-d1bfb72-nyc3a
strict-transport-security
max-age=15552000; includeSubDomains; preload
age
0
x-rgw-object-type
Normal
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1638263311.dop218.lo4.t,1638263311.cds292.lo4.shn,1638263311.dop218.lo4.t,1638263311.cds210.lo4.c

Redirect headers

content-length
0
location
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control
no-cache
sync.html
public.servenobid.com/ Frame 84C7 		8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://public.servenobid.com/sync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:46::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
31d5648df5eebdf3d492b355285870ced53b93143889c04edf9deb94357dd6e6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

cache-control
max-age=86400
content-type
text/html
content-encoding
br
last-modified
Mon, 08 Nov 2021 19:40:02 GMT
accept-ranges
bytes
etag
"1484c6be7981ef2d93457ae1b8222f04"
x-cache
TCP_HIT
server
AmazonS3
x-amz-id-2
GJLkTq+4O+mkuRD3AuLfQNX/9/QyAhAi4DvvyMhfRCOOTGBt1+nEtIOaTk+Roe/o+6GlzfyNQpg=
x-amz-request-id
FG38JP331D6E637F
x-amz-meta-codebuild-content-sha256
62eaff6ee8ff549c0050f611ee47c040b5383016dfbf921a2d194f6354569f2b
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:d8405d4a-5b5c-467c-aa1e-ad154dcb077c
x-amz-meta-codebuild-content-md5
81217ffa8e68730be30130a20e0871d1
x-azure-ref
0D+qlYQAAAAApGyNf5QUXRLgBKKTodClbTE9OMjFFREdFMDExOAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date
Tue, 30 Nov 2021 09:08:31 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 2D20 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Sun, 28 Nov 2021 05:36:04 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Tue, 30 Nov 2021 09:08:31 GMT
Age
12742
X-Served-By
cache-lga21972-LGA, cache-lcy19253-LCY
X-Cache
HIT, HIT
X-Cache-Hits
4, 89388
X-Timer
S1638263312.524891,VS0,VE0
Vary
Accept-Encoding
ixmatch.html
js-sec.indexww.com/um/ Frame 8E64 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1151
Date
Tue, 30 Nov 2021 09:08:31 GMT
Connection
keep-alive
pd
eu-u.openx.net/w/1.0/ Frame F801 		542 B
358 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
a2d4f4b9bd1c70bd929d55b7cf4460eff853e9caee9ace228400c4e0c4d82b74

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html
content-length
339
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
sync
eb2.3lift.com/ Frame A84E
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
2a196af0bd6fcb154dc9e56868902b30be1deffcac0b48378c1b9cfd23beae37

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html; charset=utf-8
content-length
463
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 87B0 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48418
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:31 GMT
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 3EA4 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 30 Nov 2021 09:08:31 GMT
Connection
keep-alive
Vary
Accept-Encoding
beacon
ap.lijit.com/ Frame 77AC 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13394437
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b403518c7d5d2fb1f557ec8404d46d72e9eaf88389fd92fc75b8ec8438e719af

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/

Response headers

Server
nginx
Date
Tue, 30 Nov 2021 09:08:31 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Vary
Accept-Encoding
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
X-Powered-By
raptor
Content-Encoding
gzip
X-Sovrn-Pod
ad_ap2ams1
activeview
pagead2.googlesyndication.com/pcs/ Frame 4115 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvFCr5qX6I74tanfgqqgzs7X5HaM3fnp0tZWkZWiRGTZnGSTVIWshANtLKw8rhk_-2la0ryM5DxF50tDn2gOFyz_cgYyrtZijK6qQoTL-_lJo1NZjE&sai=AMfl-YS9vtIQfdkejHJJ0pmS4VTY5zHFPM0Kyl9eIx81eKhYyAkp5k4UmuWfnIQqaIUqRwjrs0t9y0A7K1wqIvw5o9hkggMlCxcyoaejeFw5t4YTPOOWL15mGkD0i1zuH2U&sig=Cg0ArKJSzNNehAviulCtEAE&cid=CAASFeRoZFdozcE_Jb4tqbjlpROFw0nN_w&id=lidar2&mcvt=1033&p=416,1082,670,1382&mtos=0,1033,1033,1033,1033&tos=0,1033,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=1414505084&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638263306608&rpt=3359&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dds
rtb.openx.net/sync/ Frame F801 		43 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
66qeqgr5nvq410mmk7c2gat7trl3mvet
d6d2d192-2df0-e2cc-f885-bc46d3d2afe5
pr-bh.ybp.yahoo.com/sync/openx/ Frame F801 		43 B
870 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/d6d2d192-2df0-e2cc-f885-bc46d3d2afe5?gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:d29:3601:ba88:8e4e:431:61be Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
eu-u.openx.net/w/1.0/ Frame F801
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=uotbja5c1MRZ7N5
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=uotbja5c1MRZ7N5
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-02cbf440f9d738c39@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=uotbja5c1MRZ7N5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame F801
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=openx
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dopenx
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dopenx
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=53796c53-a8e5-4a26-ac1e-9424f8b6f92c&ssp=openx
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072968&val=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
//us-u.openx.net/w/1.0/sd?id=537072968&val=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Date
Tue, 30 Nov 2021 09:08:32 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sd
eu-u.openx.net/w/1.0/ Frame F801
Redirect Chain
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=1130723691766142237
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=1130723691766142237
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
c24f47b7-1be3-405a-80d7-8c7085f414b0
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=1130723691766142237
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
adx
match.prod.bidr.io/cookie-sync/ Frame F801
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ox
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCaldFN0RTOVFBQUN0M3hORVJxQQ&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
43 B
430 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
HTTP/1.1
Server
52.16.229.21 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-229-21.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control
no-cache, must-revalidate
Connection
keep-alive
content-type
image/gif
Content-Length
43
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
360
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 77AC 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
213.19.162.80 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
54ab5e55007c9747024b4f039df5ce6b
Content-Type
image/gif
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=16&3pid=no-consent&gdpr=1&gdpr_consent=
0
901 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=16&3pid=no-consent&gdpr=1&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://ce.lijit.com/merge?pid=16&3pid=no-consent&gdpr=1&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=87&3pid=b57f3c75-9f18-41d4-85b3-bee7f9b0b921
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=87&3pid=b57f3c75-9f18-41d4-85b3-bee7f9b0b921
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location
//ce.lijit.com/merge?pid=87&3pid=b57f3c75-9f18-41d4-85b3-bee7f9b0b921
Date
Tue, 30 Nov 2021 09:08:31 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=17&mt_exuid=b6671e3b1468cdefc62a5f06&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D3%263pid%3D%5BUUID%5D&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=3&3pid=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=3&3pid=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
MT3 4133 baa842e master zrh-pixel-x25 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://ce.lijit.com/merge?pid=3&3pid=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 30 Nov 2021 09:08:30 GMT
sync
ads.servenobid.com/ Frame 77AC
Redirect Chain
  • https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3234479222
  • https://sync.1rx.io/usersync/tradedesk/baec76b8-1fae-471f-8226-e5fbe7c59c0c
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
  • https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
0
361 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H2
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
date
Tue, 30 Nov 2021 09:08:32 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX45f3151b1d614bf68195425696e1ec5e003
content-type
text/html
sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 77AC 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
c52bde874ac36e8646ae455e9e84952e
Content-Type
image/gif
pixel
cm.g.doubleclick.net/ Frame 77AC
Redirect Chain
  • https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=YjY2NzFlM2IxNDY4Y2RlZmM2MmE1ZjA2&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=YjY2NzFlM2IxNDY4Y2RlZmM2MmE1ZjA2&gdpr=0
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H3
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=YjY2NzFlM2IxNDY4Y2RlZmM2MmE1ZjA2&gdpr=0
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap2ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1
  • https://ce.lijit.com/merge?pid=85&3pid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=85&3pid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=85&3pid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://bcp.crwdcntrl.net/5/c=5436/tp=SVRN/tpid=b6671e3b1468cdefc62a5f06/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
  • https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=b6671e3b1468cdefc62a5f06/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=5001&3pid=771919e7d17ffd103da5ab588dafe287&gdpr=0&gdpr_consent=
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=5001&3pid=771919e7d17ffd103da5ab588dafe287&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://ce.lijit.com/merge?pid=5001&3pid=771919e7d17ffd103da5ab588dafe287&gdpr=0&gdpr_consent=
cache-control
no-cache
x-server
10.45.5.130
content-length
0
expires
0
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=Uy24nQB96ZFIeb-ZAS_0mAcl6ZFILOyYUyWEd0tv
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=Uy24nQB96ZFIeb-ZAS_0mAcl6ZFILOyYUyWEd0tv
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=Uy24nQB96ZFIeb-ZAS_0mAcl6ZFILOyYUyWEd0tv
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
generic
data.adsrvr.org/track/cmf/ Frame 77AC 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
cksync.php
contextual.media.net/ Frame 77AC 		44 B
289 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=3&type=sov&ovsid=b6671e3b1468cdefc62a5f06&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1023%263pid%3D%24%7BUSER%7D&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1681cb2b2db935f48c843351945df3f3f77f79c1c8de28c4fa88d8b655c25ae2
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Tue, 30 Nov 2021 09:08:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
44
x-mnet-hl2
E
expires
Tue, 30 Nov 2021 09:08:31 GMT
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=49&3pid=h2HhD6496tI5&ev=1&pid=558511&gdpr_consent=&gdpr=0
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=49&3pid=h2HhD6496tI5&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-GB
location
https://ce.lijit.com/merge?pid=49&3pid=h2HhD6496tI5&ev=1&pid=558511&gdpr_consent=&gdpr=0
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-544c4f9c45-skgqv
expires
-1
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=12&3pid=1130723691766142237&gdpr=0&gdpr_consent=
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=12&3pid=1130723691766142237&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
f3ef9222-513a-4f67-b692-62d75d7acd75
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ce.lijit.com/merge?pid=12&3pid=1130723691766142237&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
101957
jadserve.postrelease.com/suid/ Frame 77AC 		43 B
427 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/suid/101957?ntv_r=https://ce.lijit.com/merge?pid=90&3pid=NTV_USER_ID&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.19.13.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-19-13-13.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://aorta.clickagy.com/pixel.gif?ch=185&cm=b6671e3b1468cdefc62a5f06&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=84&3pid=c:953a830b82e426f0303e7bec2ebff883
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=84&3pid=c:953a830b82e426f0303e7bec2ebff883
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date
Tue, 30 Nov 2021 09:08:32 GMT
server
Aorta/20211029.2f91d75
access-control-allow-origin
access-control-max-age
31536000
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/plain
Location
https://ce.lijit.com/merge?pid=84&3pid=c:953a830b82e426f0303e7bec2ebff883
access-control-expose-headers
Set-Cookie
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
X-Aorta-Region
us-east-1
Connection
keep-alive
X-Aorta-Host
ip-10-42-23-185.ec2.internal
access-control-allow-headers
Origin,cache-control,content-type,man,messagetype,soapaction
Content-Length
0
iu3
aax-eu.amazon-adsystem.com/s/ Frame 77AC
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
  • https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
52.95.119.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
JBX3C9NW7ZYW2X04F26D
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
reporting
ap.lijit.com/dsp/google/ Frame 77AC
Redirect Chain
  • https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=YjY2NzFlM2IxNDY4Y2RlZmM2MmE1ZjA2&gdpr=0
  • https://ap.lijit.com/dsp/google/reporting?gdpr=0
43 B
552 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ap.lijit.com/dsp/google/reporting?gdpr=0
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
P3P
CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin
*
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap2ams1
Content-Type
image/gif
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ap.lijit.com/dsp/google/reporting?gdpr=0
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
245
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=1827&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=10&3pid=5142336718970418140
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=10&3pid=5142336718970418140
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location
https://ce.lijit.com/merge?pid=10&3pid=5142336718970418140
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
  • https://ce.lijit.com/merge?pid=86&3pid=FtmPq0W5wKG8DnOE0zfx&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=86&3pid=FtmPq0W5wKG8DnOE0zfx&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=86&3pid=FtmPq0W5wKG8DnOE0zfx&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT, Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=27&uid=b6671e3b1468cdefc62a5f06&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=66&3pid=626567909448
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=66&3pid=626567909448
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

access-control-allow-origin
*
content-length
0
location
https://ce.lijit.com/merge?pid=66&3pid=626567909448
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://um.simpli.fi/lj_match?r=1638263311530&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=2&3pid=89826316FD594721B7F44E0BE3B1CA45
0
901 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=2&3pid=89826316FD594721B7F44E0BE3B1CA45
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
x-content-type-options
nosniff
server
nginx
location
https://ce.lijit.com/merge?pid=2&3pid=89826316FD594721B7F44E0BE3B1CA45
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Mon, 29 Nov 2021 09:08:31 GMT
merge
ce.lijit.com/ Frame 77AC
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent=
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=fmx&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=fmx&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=b705a7be-a449-4530-aad1-68df0e501ffb&user_group=1&ssp=fmx&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://ce.lijit.com/merge?pid=26&3pid=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=26&3pid=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location
//ce.lijit.com/merge?pid=26&3pid=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Date
Tue, 30 Nov 2021 09:08:32 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
noop
px.owneriq.net/ Frame 77AC
Redirect Chain
  • https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent=
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q6915497121270947050&ref=%2Feucm%2Fp%2Fsv
  • https://px.owneriq.net/noop?ct=image%2Fgif
0
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.owneriq.net/noop?ct=image%2Fgif
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Server
104.111.242.53 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-242-53.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache/2.2.15 (CentOS)
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
X-Powered-By
PHP/5.3.3
Content-Length
0
Content-Type
image/gif

Redirect headers

Location
https://px.owneriq.net/noop?ct=image%2Fgif
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
AkamaiGHost
Connection
keep-alive
Content-Length
0
async_usersync
ib.adnxs.com/ Frame 2D20 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
d9f54735-91bc-447c-9ffa-20edaea484f8
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usermatch
ssum-sec.casalemedia.com/ Frame AB17 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
53fc57303cb2c4b4dd219016942c15e87b1d9bd29e5124b8a6d577ba89c7a92b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://js-sec.indexww.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
73|46|4|88|8|65|230|156
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1567
Expires
Tue, 30 Nov 2021 09:08:31 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Connection
keep-alive
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 46C1 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=1&gdpr_consent=ABCFETYFDJLNBFCV&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48418
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:31 GMT
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame B988 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48418
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:31 GMT
vary
Accept-Encoding
cm
us-u.openx.net/w/1.0/ Frame D93F 		0
35 B 		Document
General
Check archive.org
Download Go to
Full URL
https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html
content-length
20
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
0608867b
rtb.gumgum.com/usync/ Frame 9CD5 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
386fa8853d7a8c212833edc9522b523e0c0ab0790847fcd91021f5daefa1d170

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
etag
W/"0fbd73c91da187510a3dc22105b490d89"
timing-allow-origin
*
content-encoding
gzip
merge
ce.lijit.com/ Frame 9A7A
Redirect Chain
  • https://d.turn.com/r/dd/id/L21rdC8xMjcvY2lkLzI4NTUyOTczL3QvMg/url/https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1%263pid%3D%24!%7BTURN_UUID%7D&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=1&3pid=3239295199777413054&gdpr=0&gdpr_consent=
43 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ce.lijit.com/merge?pid=1&3pid=3239295199777413054&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13394437
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://ap.lijit.com/

Response headers

Server
nginx
Date
Tue, 30 Nov 2021 09:08:31 GMT
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap4ams1

Redirect headers

p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
pragma
no-cache
location
https://ce.lijit.com/merge?pid=1&3pid=3239295199777413054&gdpr=0&gdpr_consent=
content-length
0
date
Tue, 30 Nov 2021 09:08:31 GMT
13926
g2.gumgum.com/usync/ Frame F9C6 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.249.15.20 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-249-15-20.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
66472652c9ad939bc6f65d6936479839c0eb3b1030e0aef80dd74d0c8fc4a47b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
etag
W/"0a42fa2d50cd64f977456ffcfffba1949"
timing-allow-origin
*
content-encoding
gzip
ps
pixel.33across.com/ Frame A605 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip21.67-202-105.static.steadfastdns.net
Software
33XP005 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/

Response headers

x-33x-status
2000208
server
33XP005
date
Tue, 30 Nov 2021 09:08:31 GMT
/
onetag-sys.com/usync/ Frame D498 		2 KB
814 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip254.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/

Response headers

content-type
text/html
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
strict-transport-security
max-age=15552000
sync
ssbsync.smartadserver.com/api/ Frame D37A 		884 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.132 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
9a959dbaba9216a8be8a43b07caaad3f98fcf497125224b3785ed96f5d20e66f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html
content-length
884
usermatch
ssum-sec.casalemedia.com/ Frame B337 		1 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d0cc02919084686c517bcb7c35a4418920ac51eacddcf67e50bd5b55f1d78849

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
46|73|130|4|191|176|5|3
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1415
Expires
Tue, 30 Nov 2021 09:08:31 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Connection
keep-alive
sync
ads.servenobid.com/ Frame 84C7
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
  • https://ads.servenobid.com/sync?pid=312&uid=1130723691766142237
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=312&uid=1130723691766142237
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
ba88ba6b-20f8-478b-b2df-3854a15b7b42
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ads.servenobid.com/sync?pid=312&uid=1130723691766142237
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
ads.servenobid.com/ Frame 84C7
Redirect Chain
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
  • https://ads.servenobid.com/sync?pid=310&uid=b6671e3b1468cdefc62a5f06
0
347 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=310&uid=b6671e3b1468cdefc62a5f06
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ads.servenobid.com/sync?pid=310&uid=b6671e3b1468cdefc62a5f06
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
sync
ads.servenobid.com/ Frame 84C7
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4724393866
  • https://sync.1rx.io/usersync/tradedesk/baec76b8-1fae-471f-8226-e5fbe7c59c0c
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
  • https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
0
361 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=321&uid=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
date
Tue, 30 Nov 2021 09:08:32 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX45f3151b1d614bf68195425696e1ec5e003
content-type
text/html
101954
jadserve.postrelease.com/suid/ Frame 84C7 		43 B
428 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/suid/101954?ntv_r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D322%26uid%3DNTV_USER_ID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.19.13.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-19-13-13.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
sync
ads.servenobid.com/ Frame 84C7
Redirect Chain
  • https://p.rfihub.com/cm?pub=44007&in=1
  • https://ads.servenobid.com/sync?pid=324&uid=5142336718970418140
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=324&uid=5142336718970418140
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Location
https://ads.servenobid.com/sync?pid=324&uid=5142336718970418140
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
usa
sync.go.sonobi.com/ Frame 84C7 		0
474 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
sync
ads.servenobid.com/ Frame 84C7
Redirect Chain
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
  • https://ads.servenobid.com/sync?pid=327&uid=430cfaba-49db-418d-9caf-960d8e2e9748&gdpr=0&gdpr_consent=&us_privacy=1YN-
0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=327&uid=430cfaba-49db-418d-9caf-960d8e2e9748&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=327&uid=430cfaba-49db-418d-9caf-960d8e2e9748&gdpr=0&gdpr_consent=&us_privacy=1YN-
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
1
server
envoy
content-length
0
sync
t.adx.opera.com/pub/ Frame 84C7 		0
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.adx.opera.com/pub/sync?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D335%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
82.145.213.8 , Norway, ASN39832 (NO-OPERA, NO),
Reverse DNS
n-sysadmin-jumpbox-03.feednews.opera.technology
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
Tengine
access-control-allow-methods
POST, GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 3EA4 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
65445aacbafe7ae9e7c21a38e05b09e0b8af45eb6c11e4bd0a4816d836d016ca

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=56885
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9511
Expires
Wed, 01 Dec 2021 00:56:36 GMT
generic
match.adsrvr.org/track/cmf/ Frame A84E 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
xuid
eb2.3lift.com/ Frame A84E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEH02qP1h8PWo9l2tBwvn3rE&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEH02qP1h8PWo9l2tBwvn3rE&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEH02qP1h8PWo9l2tBwvn3rE&dongle=c627&gdpr=1&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame A84E
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1MTk0NDAxODE5MzgyNTAyMDc%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1MTk0NDAxODE5MzgyNTAyMDc%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTE1MTk0NDAxODE5MzgyNTAyMDc%3D
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
setuid
px.ads.linkedin.com/ Frame A84E 		0
597 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=11519440181938250207&dbredirect=true&gdpr=1&consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:119:50e5:101::9002:c05 San Francisco, United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lva1
x-li-proto
http/2
x-li-pop
prod-lva1
content-length
0
x-li-uuid
I7OObc1HvBbgn4/z3SoAAA==
xuid
eb2.3lift.com/ Frame A84E
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/11519440181938250207?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-JScxTgxE2oSYnm5axIk1o66HwsnbrbvPtyy3vrKNvA--~A&dongle=0883
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-JScxTgxE2oSYnm5axIk1o66HwsnbrbvPtyy3vrKNvA--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-JScxTgxE2oSYnm5axIk1o66HwsnbrbvPtyy3vrKNvA--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
sync
x.bidswitch.net/ Frame A84E 		43 B
220 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?ssp=triplelift&user_id=11519440181938250207&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.121.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-121-212.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
c.gif
c.bing.com/ Frame A84E 		42 B
594 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=11519440181938250207&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:30 GMT
etag
"f95a3e4769d2d71:0"
last-modified
Fri, 05 Nov 2021 17:19:23 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 20D800CAE614404BB743B613572F7C3B Ref B: LON04EDGE1217 Ref C: 2021-11-30T09:08:31Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
iu3
s.amazon-adsystem.com/ Frame A84E
Redirect Chain
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=11519440181938250207
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=11519440181938250207&dcc=t
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=11519440181938250207&dcc=t
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
JSHJ6PDV9TSRR58K58SN
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=11519440181938250207&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
xuid
eb2.3lift.com/ Frame A84E
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
37 B
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

Location
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
95
Content-Type
text/html; charset=utf-8
xuid
eb2.3lift.com/ Frame A84E
Redirect Chain
  • https://ad.turn.com/r/cs?pid=49&gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=4771&xuid=3022260984283505521&dongle=d407
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=4771&xuid=3022260984283505521&dongle=d407
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://eb2.3lift.com/xuid?mid=4771&xuid=3022260984283505521&dongle=d407
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame AB17 		43 B
869 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB?gdpr_consent=&us_privacy=&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:d29:3601:ba88:8e4e:431:61be Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
getuid
secure.adnxs.com/ Frame AB17 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
rum
dsum-sec.casalemedia.com/ Frame AB17
Redirect Chain
  • https://ad.turn.com/r/cs?pid=21&gdpr=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3094318578321433457
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3094318578321433457
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:32 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3094318578321433457
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame AB17 		85 B
259 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1638263312.788737,VS0,VE78
x-served-by
cache-lcy19242-LCY
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
content-type
image/png
content-length
85
x-cache-hits
0
crum
dsum-sec.casalemedia.com/ Frame AB17
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/ix.gif
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:32 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&expiration=1669799311
date
Tue, 30 Nov 2021 09:08:31 GMT
server
Kestrel
content-length
0
rum
dsum.casalemedia.com/ Frame AB17
Redirect Chain
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1&gdpr=1
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1638349711&gdpr=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1638349711&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:32 GMT

Redirect headers

location
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1638349711&gdpr=1
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
content-length
0
expires
0
usermatchredir
ssum-sec.casalemedia.com/ Frame AB17
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB&gdpr_consent=&us_privacy=&gdpr=1
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:31 GMT

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEDpfHiD0yirA64N4AEXY2LE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookiesync
bttrack.com/pixel/ Frame AB17 		35 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS
46.bidtellect.com
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

X-ServerName
Track004-dc3
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:30 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
htw-pixel.gif
js-sec.indexww.com/ht/ Frame AB17 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?YaXqDmdMgARsAxdRjdxjjQAA%261821
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://threatpost.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=1368
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:31:19 GMT
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
  • https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
c665522a-9326-47dc-8608-b0a03f46b86f
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_a6452d23-5ce2-479e-b91d-1f0b66f80513&gdpr=0&gdpr_consent=&us_privacy=
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=b705a7be-a449-4530-aad1-68df0e501ffb&user_group=1&ssp=gumgum2&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
//rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Date
Tue, 30 Nov 2021 09:08:32 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=sta&i=0-82f1fa72-68fb-45b9-6048-dedb9eb08564$ip$89.238.142.215
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=sta&i=0-82f1fa72-68fb-45b9-6048-dedb9eb08564$ip$89.238.142.215
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=sta&i=0-82f1fa72-68fb-45b9-6048-dedb9eb08564$ip$89.238.142.215
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
Content-Length
123
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_a6452d23-5ce2-479e-b91d-1f0b66f80513&gdpr=0&gdpr_consent=&us_privacy=
  • https://rtb.gumgum.com/usersync?b=zem&i=&gdpr=0
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=zem&i=&gdpr=0
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=zem&i=&gdpr=0
Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
78
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003&rndcb=1800554444
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=98d76fa9-5328-4570-b396-d13f5c3fbb99&ssp=adconductor&expires=30&user_group=5&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://sync.1rx.io/usersync/bidswitch/fab7c4a6-2a45-4e9e-8d31-621eb4f79233?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
date
Tue, 30 Nov 2021 09:08:32 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX45f3151b1d614bf68195425696e1ec5e003
content-type
text/html
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://rtb.gumgum.com/usersync?b=pln&i=y7uTHXrBROn7&ev=1&pid=558355
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=pln&i=y7uTHXrBROn7&ev=1&pid=558355
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-GB
location
https://rtb.gumgum.com/usersync?b=pln&i=y7uTHXrBROn7&ev=1&pid=558355
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-544c4f9c45-d6f25
expires
-1
cookie-sync
sync.outbrain.com/ Frame 9CD5
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_593e0f56-57f2-437d-8d59-8add6b779ffc&obuid=ENC(EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82)
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
  • https://sync.hgrtb.com/outbrain?cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dmediaforce_custom%26obUid%3DEIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82%26uid%3D%7BUSER_I...
  • https://sync.outbrain.com/cookie-sync?p=mediaforce_custom&obUid=EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82&uid=a83faa2b-448f-4307-9aa0-69172bcd385c
0
320 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=mediaforce_custom&obUid=EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82&uid=a83faa2b-448f-4307-9aa0-69172bcd385c
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
64.202.112.159 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:33 GMT
Cache-Control
no-cache
X-TraceId
551eadb1b268517d4446f07c4ee446ce
Content-Length
0

Redirect headers

Location
https://sync.outbrain.com/cookie-sync?p=mediaforce_custom&obUid=EIbgwOb_2sPcUkbxJWtPFeY2-MvtJM0imqTQZShVwJIs7tKz87sMn8e2J5YPM-82&uid=a83faa2b-448f-4307-9aa0-69172bcd385c
Date
Tue, 30 Nov 2021 09:08:33 GMT
Connection
keep-alive
Content-Length
200
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%...
  • https://rtb.gumgum.com/usersync?b=vnt&i=174af63b-51bd-11ec-b606-850e07abf4e3
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=vnt&i=174af63b-51bd-11ec-b606-850e07abf4e3
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=vnt&i=174af63b-51bd-11ec-b606-850e07abf4e3
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
174af63c-51bd-11ec-b606-850e07abf4e3
services
sync.technoratimedia.com/ Frame 9CD5 		0
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
132.226.41.106 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
489695334
access-control-allow-origin
https://rtb.gumgum.com/
access-control-allow-credentials
true
142
match.deepintent.com/usersync/ Frame 9CD5 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
c /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
server
c
usersync
rtb.gumgum.com/ Frame 9CD5
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
date
Tue, 30 Nov 2021 09:08:32 GMT
access-control-allow-origin
*
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
sync
ssbsync.smartadserver.com/api/ Frame 9CD5 		0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.132 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
merge
ce.lijit.com/ Frame 9CD5 		0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=36&3pid=e_a6452d23-5ce2-479e-b91d-1f0b66f80513
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-MERGE
GDPR Optout true
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap4ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT
ca
choices.trustarc.com/ Frame 2AD8 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=300&h=600&c=digitas01cont5&js=pmw1&base=te-clr1-e707f719-79b8-4c60-b198-ec9da8806410
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-60.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
3b5bb1dd6c9ec6ba0bf39c35ed5a8934564df7f9555df7da742d3afa2da230b6

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 08:40:44 GMT
content-encoding
gzip
server
nginx
age
1667
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
FRA2-C1
content-length
2468
x-amz-cf-id
a8KC7mFJIX_08LjEXVn5BEf_E4kRpl_RxaVI2yb6RWgLuMvgat2qFQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 2AD8 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=300&h=600&c=digitas01cont5&js=pmw2
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-60.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 29 Nov 2021 10:29:27 GMT
content-encoding
gzip
server
nginx
age
81543
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
DQb3fESkZMlfxLkvMHsGfYrRPSFaaAsgA5M14euN72gVkwZrK4AW8Q==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 2AD8 		43 B
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=hpeus01&pid=digitas01&cid=1&w=300&h=600&c=f529
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-60.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
via
1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
FRA2-C1
vary
Origin
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
x-amz-cf-id
Zvhz9Vbvt-rqb2ux5UJWJcsAvBDpXqnMR011U2rx16HZQQnDDqcmVw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
getuid
secure.adnxs.com/ Frame B337 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame B337 		43 B
869 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB?gdpr_consent=&us_privacy=&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:d29:3601:ba88:8e4e:431:61be Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
ie
match.prod.bidr.io/cookie-sync/ Frame B337 		43 B
430 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.prod.bidr.io/cookie-sync/ie?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.229.21 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-229-21.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control
no-cache, must-revalidate
Connection
keep-alive
content-type
image/gif
Content-Length
43
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame B337
Redirect Chain
  • https://ad.turn.com/r/cs?pid=21&gdpr=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3239295199777413054
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3239295199777413054
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:32 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3239295199777413054
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
index
dmp.brand-display.com/cm/api/ Frame B337 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3CIndex_user_id%3E&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.40.233 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
233.40.241.35.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
via
1.1 google
last-modified
Tue, 30 Nov 2021 09:08:32 GMT
server
nginx/1.20.2
content-type
image/gif
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
alt-svc
clear
content-length
43
expires
Tue, 30 Nov 2021 09:08:33 GMT
113
match.deepintent.com/usersync/ Frame B337 		0
16 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/113
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
c /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
server
c
ix
ad4m.at/ad/sim/ Frame B337 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad4m.at/ad/sim/ix?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
crum
dsum-sec.casalemedia.com/ Frame B337
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D&gdpr=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=1&gdpr_consent=
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=1&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 30 Nov 2021 09:08:32 GMT

Redirect headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
MT3 4133 baa842e master zrh-pixel-x24 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=1&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 30 Nov 2021 09:08:30 GMT
sync
ads.servenobid.com/ Frame B337 		0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=333&uid=YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 5775 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48418
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:31 GMT
vary
Accept-Encoding
usersync
rtb.gumgum.com/ Frame 5B19
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html
content-length
209
location
https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usync.html
eus.rubiconproject.com/ Frame 27F6
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=gumgum
Date
Tue, 30 Nov 2021 09:08:31 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
usersync
rtb.gumgum.com/ Frame 6BA3
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Content-Type
image/gif
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=360
Access-Control-Allow-Origin
*
Server
MT3 4133 baa842e master zrh-pixel-x28 config:1.0.0
Cache-Control
no-cache
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Expires
Tue, 30 Nov 2021 09:08:30 GMT
usersync
rtb.gumgum.com/ Frame 75F3
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

server
Varnish
retry-after
0
location
https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
accept-ranges
bytes
date
Tue, 30 Nov 2021 09:08:31 GMT
via
1.1 varnish
x-served-by
cache-lcy19242-LCY
x-cache
HIT
x-cache-hits
0
x-timer
S1638263312.900885,VS0,VE0
cache-control
no-cache
pragma
no-cache
content-length
0
pixel
cm.g.doubleclick.net/ Frame A0C7 		170 B
188 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9hNjQ1MmQyMy01Y2UyLTQ3OWUtYjkxZC0xZjBiNjZmODA1MTM=&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

content-type
image/png
date
Tue, 30 Nov 2021 09:08:31 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
server
HTTP server (unknown)
content-length
170
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
ssc-cms.33across.com/ps/ Frame 9DEF 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip21.67-202-105.static.steadfastdns.net
Software
33XP002 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

x-33x-status
2000208
server
33XP002
date
Tue, 30 Nov 2021 09:08:31 GMT
um
cs.emxdgt.com/ Frame 356A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

content-type
text/html
date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
usersync
rtb.gumgum.com/ Frame DF6D
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5ukAAKqmDKkAAAAA
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5ukAAKqmDKkAAAAA
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Server
nginx
Date
Tue, 30 Nov 2021 09:08:32 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
private
Location
https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5ukAAKqmDKkAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time
2
X-SO-HostName
m-ad302.dc4p.scaleout.jp
X-SO-LB-Hostname
a-tgng40018.dc2p.scaleout.jp
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":46,"gdpr":true,"ipv4":"0.0.0.0","key":"YaXqEMCo5ukAAKqmDKkAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad302"}
X-SO-Key
YaXqEMCo5ukAAKqmDKkAAAAA
X-SO-IP
89.238.142.215
X-SO-Cluster-ID
46
X-SO-Upstream-ID
m-ad302
usersync
rtb.gumgum.com/ Frame 19F4
Redirect Chain
  • https://p.rfihub.com/cm?pub=42796&in=1
  • https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Content-Length
0
Server
Jetty(9.3.29.v20201019)
usersync
rtb.gumgum.com/ Frame 0581
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://rtb.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Tue, 30 Nov 2021 09:08:32 GMT Tue, 30 Nov 2021 09:08:32 GMT
location
https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-length
0
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
  • https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:31 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
4743b03d-4208-49dd-a196-377dae51ca29
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://rtb.gumgum.com/usersync?b=apn&i=1130723691766142237
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_593e0f56-57f2-437d-8d59-8add6b779ffc&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=gumgum2&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=gumgum2&gdpr=0&user_id=jE7ZLt8eiCKXGt4q3kyVK9hGiCKXT40rjEbsaRvQ
  • https://rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
//rtb.gumgum.com/usersync?b=bsw&i=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
Date
Tue, 30 Nov 2021 09:08:32 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=sta&i=0-5bb60842-c657-42ec-7e6c-cc082bd2a647$ip$89.238.142.215
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=sta&i=0-5bb60842-c657-42ec-7e6c-cc082bd2a647$ip$89.238.142.215
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=sta&i=0-5bb60842-c657-42ec-7e6c-cc082bd2a647$ip$89.238.142.215
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
Content-Length
123
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_593e0f56-57f2-437d-8d59-8add6b779ffc&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://stags.bluekai.com/site/23178?id=lwCPDZZPoXDoqqAGvDcZ&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT23DXINIEIWS2KBXVQRDPOFYUCR3WIRRVUJTVONPXA...
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=lwCPDZZPoXDoqqAGvDcZ&us_privacy=1---
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=lwCPDZZPoXDoqqAGvDcZ&us_privacy=1---
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:33 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
P3p
CP="We do not support P3P header."
Location
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=lwCPDZZPoXDoqqAGvDcZ&us_privacy=1---
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
118
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003&rndcb=6674860021
  • https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=fab7c4a6-2a45-4e9e-8d31-621eb4f79233&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
  • https://x.bidswitch.net/sync?dsp_id=283&user_id=8745dc56-754a-4b93-98ae-0fa50d57708c&expires=1&user_group=5&ssp=adconductor&bsw_param=fab7c4a6-2a45-4e9e-8d31-621eb4f79233
  • https://sync.1rx.io/usersync/bidswitch/fab7c4a6-2a45-4e9e-8d31-621eb4f79233?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=rhy&i=RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
date
Tue, 30 Nov 2021 09:08:32 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX45f3151b1d614bf68195425696e1ec5e003
content-type
text/html
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://rtb.gumgum.com/usersync?b=pln&i=dHeAzadHdrMs&ev=1&pid=558355
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=pln&i=dHeAzadHdrMs&ev=1&pid=558355
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-GB
location
https://rtb.gumgum.com/usersync?b=pln&i=dHeAzadHdrMs&ev=1&pid=558355
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-stage-0
expires
-1
/
tempsyncurl.com/ Frame F9C6
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28oolCbMdrA2OJf12hbkCH-PIIqkIZcGqhQ-2YYWwi4PTKz-I4ZAn68fWXomgoyGOr%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_593e0f56-57f2-437d-8d59-8add6b779ffc&obuid=ENC(oolCbMdrA2OJf12hbkCH-PIIqkIZcGqhQ-2YYWwi4PTKz-I4ZAn68fWXomgoyGOr)
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
  • https://tempsyncurl.com/
0
0
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://rtb.gumgum.com/usersync?b=opx&i=b52813a6-9549-48d3-ae29-ba5ee4d563ea
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://rtb.gumgum.com/usersync?b=oth&i=y-LcP946BE2pdw8yYk0tYWjD6K40Odb5Wxvh_C~A
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
  • https://rtb.gumgum.com/usersync?b=vnt&i=175136f7-51bd-11ec-91c0-1b27083715d9
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=vnt&i=175136f7-51bd-11ec-91c0-1b27083715d9
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=vnt&i=175136f7-51bd-11ec-91c0-1b27083715d9
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
175136f8-51bd-11ec-91c0-1b27083715d9
services
sync.technoratimedia.com/ Frame F9C6 		0
292 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
132.226.41.106 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
454606273
access-control-allow-origin
https://g2.gumgum.com/
access-control-allow-credentials
true
142
match.deepintent.com/usersync/ Frame F9C6 		0
16 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
c /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
server
c
usersync
rtb.gumgum.com/ Frame F9C6
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=idi&i=36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
date
Tue, 30 Nov 2021 09:08:32 GMT
access-control-allow-origin
*
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
sync
ssbsync.smartadserver.com/api/ Frame F9C6 		0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.132 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
sync
ads.servenobid.com/ Frame F9C6 		0
358 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=309&uid=e_593e0f56-57f2-437d-8d59-8add6b779ffc
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
sync
ads.servenobid.com/ Frame D37A 		0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=317&uid=2716751734794748949&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.211.212.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-211-212-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:31 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame D37A
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=MjcxNjc1MTczNDc5NDc0ODk0OQ==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEAkZyRD-gwLg6NlHcFX7jio&gdpr=0&gdpr_consent=&google_cver=1
43 B
466 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEAkZyRD-gwLg6NlHcFX7jio&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.138.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEAkZyRD-gwLg6NlHcFX7jio&gdpr=0&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame D37A
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=1130723691766142237&gdpr=0&gdpr_consent=
43 B
435 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=1130723691766142237&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.138.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
ecde9851-908b-42ce-91eb-d99eff094ffe
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=1130723691766142237&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame D37A
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3D72348060-38ad-4586-8e4f-f1e2a8e789b3%26id%3DSMART_USE...
  • https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=2716751734794748949&gdpr=0&gdpr_consent=
43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=2716751734794748949&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
184B9XJP168ZEVQ07KG9
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=2716751734794748949&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 30 Nov 2021 09:08:31 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
redir
rtb-csync.smartadserver.com/ Frame D37A
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
43 B
412 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.138.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAE4lk7DS9QAACwML0ARqQ&gdpr=0
Date
Tue, 30 Nov 2021 09:08:31 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2965 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48418
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:31 GMT
vary
Accept-Encoding
usersync
rtb.gumgum.com/ Frame 6DD9
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Tue, 30 Nov 2021 09:08:31 GMT
content-type
text/html
content-length
209
location
https://rtb.gumgum.com/usersync?b=ttd&i=baec76b8-1fae-471f-8226-e5fbe7c59c0c&t=1640855311
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usync.html
eus.rubiconproject.com/ Frame C7AC
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=gumgum
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
usersync
rtb.gumgum.com/ Frame 1990
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
Content-Type
image/gif
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=360
Access-Control-Allow-Origin
*
Server
MT3 4133 baa842e master zrh-pixel-x24 config:1.0.0
Cache-Control
no-cache
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://rtb.gumgum.com/usersync?b=mmh&i=f0a061a5-ea0d-4f00-a403-cf47764996bb&gdpr=0&gdpr_consent=
Expires
Tue, 30 Nov 2021 09:08:30 GMT
usersync
rtb.gumgum.com/ Frame 4C9C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

server
Varnish
retry-after
0
location
https://rtb.gumgum.com/usersync?b=atm&i=YaXqDQAIZSEhowBR&gdpr=0&gdpr_consent=
accept-ranges
bytes
date
Tue, 30 Nov 2021 09:08:31 GMT
via
1.1 varnish
x-served-by
cache-lcy19242-LCY
x-cache
HIT
x-cache-hits
0
x-timer
S1638263312.977827,VS0,VE0
cache-control
no-cache
pragma
no-cache
content-length
0
pixel
cm.g.doubleclick.net/ Frame B706 		170 B
188 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV81OTNlMGY1Ni01N2YyLTQzN2QtOGQ1OS04YWRkNmI3NzlmZmM=&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
image/png
date
Tue, 30 Nov 2021 09:08:31 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
server
HTTP server (unknown)
content-length
170
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
ssc-cms.33across.com/ps/ Frame B8A8 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip21.67-202-105.static.steadfastdns.net
Software
33XP001 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

x-33x-status
2000208
server
33XP001
date
Tue, 30 Nov 2021 09:08:31 GMT
um
cs.emxdgt.com/ Frame AA6E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
text/html
date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
usersync
rtb.gumgum.com/ Frame 744F
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5sAAAFxkJAUAAAAA
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5sAAAFxkJAUAAAAA
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Server
nginx
Date
Tue, 30 Nov 2021 09:08:32 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
private
Location
https://rtb.gumgum.com/usersync?b=sus&i=YaXqEMCo5sAAAFxkJAUAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time
2
X-SO-HostName
m-ad162.dc4p.scaleout.jp
X-SO-LB-Hostname
a-tgng40002.dc2p.scaleout.jp
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":34,"gdpr":true,"ipv4":"0.0.0.0","key":"YaXqEMCo5sAAAFxkJAUAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad162"}
X-SO-Key
YaXqEMCo5sAAAFxkJAUAAAAA
X-SO-IP
89.238.142.215
X-SO-Cluster-ID
34
X-SO-Upstream-ID
m-ad162
usersync
rtb.gumgum.com/ Frame EEA6
Redirect Chain
  • https://p.rfihub.com/cm?pub=42796&in=1
  • https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Tue, 30 Nov 2021 09:08:31 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://rtb.gumgum.com/usersync?b=zet&i=5142336718970418140
Content-Length
0
Server
Jetty(9.3.29.v20201019)
usersync
rtb.gumgum.com/ Frame 09C0
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.19.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-77-19-59.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Tue, 30 Nov 2021 09:08:32 GMT Tue, 30 Nov 2021 09:08:32 GMT
location
https://rtb.gumgum.com/usersync?b=rth&i=FtmPq0W5wKG8DnOE0zfx&pi=gumgum&tc=1
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-length
0
tap.php
pixel.rubiconproject.com/ Frame 3EA4
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKTzqRCkaqXUwwr7_twY-n4&google_cver=1
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKTzqRCkaqXUwwr7_twY-n4&google_cver=1
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
611afce88997db6fdd35eb213e662871
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKTzqRCkaqXUwwr7_twY-n4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
709414.gif
id.rlcdn.com/ Frame 3EA4 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
token
token.rubiconproject.com/ Frame 3EA4 		0
0
tap.php
pixel.rubiconproject.com/ Frame 3EA4
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=f0a061a5-ea0d-4f00-a403-cf47764996bb&expires=28
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=f0a061a5-ea0d-4f00-a403-cf47764996bb&expires=28
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
611afce88997db6fdd35eb213e662871
Content-Type
image/gif

Redirect headers

Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
MT3 4133 baa842e master zrh-pixel-x9 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=f0a061a5-ea0d-4f00-a403-cf47764996bb&expires=28
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 30 Nov 2021 09:08:31 GMT
v1
ads.yahoo.com/cms/ Frame 3EA4
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWLVO99D-W-87ZX&sigv=1&esig=2~65b4a1185240ae143659cffbf5d1b4ad1aeb654f
0
468 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWLVO99D-W-87ZX&sigv=1&esig=2~65b4a1185240ae143659cffbf5d1b4ad1aeb654f
Protocol
H2
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KWLVO99D-W-87ZX&sigv=1&esig=2~65b4a1185240ae143659cffbf5d1b4ad1aeb654f
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
37b22a0c36bd84993dd2cda4a5e04b1d
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame 3EA4
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dMVk85OUQtVy04N1pY
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dMVk85OUQtVy04N1pY
Protocol
H3
Server
142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dMVk85OUQtVy04N1pY
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
704c1e4d3fcc922a3031d436b584678b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
token
token.rubiconproject.com/ Frame 3EA4 		0
0
rubicon
match.adsrvr.org/track/cmf/ Frame 3EA4 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
um
cs.emxdgt.com/ Frame 2376 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

content-type
text/html
date
Tue, 30 Nov 2021 09:08:31 GMT
content-length
0
usync.html
eus.rubiconproject.com/ Frame 9937
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40019-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
uc.html
go.sonobi.com/ Frame 715F 		43 B
573 B 		Document
General
Check archive.org
Download Go to
Full URL
https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.148 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1.go.sonobi.com
Software
sonobi-go /
Resource Hash
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

Date
Tue, 30 Nov 2021 09:08:32 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, no-store, private
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma
no-cache
Tcn
Choice
Vary
negotiate,Accept-Encoding
X-Go-Server
go-ams-1-7-8
X-Xss-Protection
0
Content-Encoding
gzip
Server
sonobi-go
cm
gift-connect-d.openx.net/w/1.0/ Frame 2DAD 		0
83 B 		Document
General
Check archive.org
Download Go to
Full URL
https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
date
Tue, 30 Nov 2021 09:08:32 GMT
content-type
text/html
content-length
20
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame BB47 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=48417
expires
Tue, 30 Nov 2021 22:35:29 GMT
date
Tue, 30 Nov 2021 09:08:32 GMT
vary
Accept-Encoding
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3D5A
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=1130723691766142237
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=1130723691766142237
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
7801de46-6235-4448-843f-d07b278a407c
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=1130723691766142237
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3D5A
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YaXqDmdMgARsAxdRjdxjjQAA%261821
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YaXqDmdMgARsAxdRjdxjjQAA%261821
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YaXqDmdMgARsAxdRjdxjjQAA%261821
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
282
Expires
Tue, 30 Nov 2021 09:08:32 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3D5A
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=b6671e3b1468cdefc62a5f06
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=b6671e3b1468cdefc62a5f06
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-length
0

Redirect headers

Date
Tue, 30 Nov 2021 09:08:32 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=b6671e3b1468cdefc62a5f06
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap2ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
usa
sync.go.sonobi.com/ Frame 3D5A 		0
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=38&userId=
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3D5A
Redirect Chain
  • https://pixel.advertising.com/ups/56621/occ
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
content-length
0

Redirect headers

location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP15d71b0a-51bd-11ec-ae5e-020c4429675e
date
Tue, 30 Nov 2021 09:08:32 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
us.gif
sync.go.sonobi.com/ Frame 3D5A
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
49 B
509 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
cache-control
no-cache
content-length
0
56939
i6.liadm.com/s/ Frame 3D5A
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c&_li_chk=true&previous_uuid=43874f65488445ffbf4724695a16eea2
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
43 B
447 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
2600:1f18:444a:4602:b51a:2bef:14:5241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:33 GMT
Cache-Control
no-store
Connection
keep-alive
trace-id
41146523a5f2a858
Content-Length
43
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
Date
Tue, 30 Nov 2021 09:08:32 GMT
Connection
keep-alive
trace-id
91939c27f9b61ebe
Content-Length
0
Strict-Transport-Security
max-age=31536000; includeSubDomains
usync.js
eus.rubiconproject.com/ Frame 27F6 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
4e87b0833dbc4021d64216db82295cda42836ba949bbd077c29e6317a65faddf

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:32 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=65625
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9513
Expires
Wed, 01 Dec 2021 03:22:17 GMT
usync.js
eus.rubiconproject.com/ Frame C7AC 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
4e87b0833dbc4021d64216db82295cda42836ba949bbd077c29e6317a65faddf

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:32 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=65625
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9513
Expires
Wed, 01 Dec 2021 03:22:17 GMT
st
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:32 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
usync.js
eus.rubiconproject.com/ Frame 9937 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
4e87b0833dbc4021d64216db82295cda42836ba949bbd077c29e6317a65faddf

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 09:08:32 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=65625
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9513
Expires
Wed, 01 Dec 2021 03:22:17 GMT
async_usersync
ib.adnxs.com/ Frame 2D20 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:32 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
6f9eb425-6a09-4f57-ab1b-114eacfb009a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync.php
pixel.rubiconproject.com/exchange/ Frame 27F6 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/0608867b?r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D36%263pid%3D&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
611afce88997db6fdd35eb213e662871
Content-Type
image/gif
SPug
simage4.pubmatic.com/AdServer/ Frame FBFF 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156858&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 9937 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=17632
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
c52bde874ac36e8646ae455e9e84952e
Content-Type
image/gif
pixel.gif
yahoovpaidtwoint215831825037.s.moatpixel.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yahoovpaidtwoint215831825037.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=2783&tet=2068&gmv=0&fvt=2068&apd=2984&h=0&th=-1&bfa=1&d=threatpost.com&sp=0&L1id=Yahoo!&L2id=347687&L3id=1799672&L4id=3651557&S1id=55&S2id=0&ord=1638263309391&r=541895839812&t=iv&zMoatAuctionID=1362287899579984651:1638263305966&zMoatAdReqDomain=threatpost.com&avoc=0&url=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&w=400&ht=225&dh=0&q=5&BSD=unsafe&BSC=moat_unsafe,gv_crime,gs_business,gs_tech_computing,gs_tech&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:32 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Tue, 30 Nov 2021 09:08:32 GMT
yv
beap-bc.yahoo.com/ Frame 1A0D 		43 B
664 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://beap-bc.yahoo.com/yv?sek=1362287899579984651:1638263305966&as=YAMPViewableImpressionPayload&av=2.19.0&kv=0&ea=1&ap=Son6_aHgj_izt1z5a77-w8tg54aSRJhh0VNV0xwshuHHwNEpcPq_KLa9jxUrk_tyEl2ZkBP7Bg7zkjc_qK2U85gI9ONUSG41f3ZxfbTJGAZzICtjbjker5f1o9VM7tIONf4VNeQ2mV0D4WimYJPcFfUnuhaS5rxZyQqjaUAaMzwgqXeMfGbiP7Nm2E4LkF4s0jKtG1d6jbfRba5mXZaoIem_pd9avJr0ve9EPXyS56z3YnDqSv77NnTJuQz8Kww4599jWjUUnAkjgBfEGY7Vvg&iv=100&v=1&m=2&r=1638263312397&im=1&b=100&ad=jv=1.0.246:vd=1:vv=2:vpov=0:fu=0:tp=1:mt=7&plw=400&plh=225
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/ff/vista.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 30 Nov 2021 09:08:32 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
p3p
policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
x-xss-protection
1; mode=block
cache-control
no-cache, private
content-type
image/gif
content-length
43
x-content-type-options
nosniff
accept-charset
utf-8
av
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/av?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:32 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
vevent
ams1-ib.adnxs.com/ 		0
826 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fthreatpost.com%2Fikea-email-reply-chain-attack%2F176625%2F&e=wqT_3QKEBeiEAgAAAwDWAAUBCInUl40GEM2wy_q-wuOUehgAKjYJ9yOYS4nmD0ARSupYTY8oCkAZAAAAYI_CHEAhSg0SBCn2DSTYMQAAAOB6FP4_MJ-ZpQg45zdAnxdItwFQlOXukgFYy496YABo56WpAXiykAWAAQGKAQNVU0SSAQEG9P0BmAEBoAEBqAEBsAEAuAEDwAEFyAEC0AEA2AEA4AEA8AEA2ALTR-AC1_c36gI8aHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9pa2VhLWVtYWlsLXJlcGx5LWNoYWluLWF0dGFjay8xNzY2MjUvgAMAiAMBkAMAmAMXoAMBqgNNEhMxMzYyMjg3ODk5NTc5OTg0NjUxGhM4ODAyNzIzMTYyOTQzMDUxODUzIgkzMDc5OTkzODAqDU9BVEgxMDE3MDAwMDA6BzM2NTE1NTfAA-CoAcgDANgDttW3AeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA44OS4yMzguMTQyLjIxNagEALIEEAgBEAQYkAMg4QEoAjAAOAO4BADABADIBADaBAIIAeAEAPAElOXukgGIBQGYBQCgBe6n3aHft5OpH8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBb2NB_oFBAgAEACQBgGYBgC4BgDBBgAAAAAAAPA_0AbkvwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYE8gYCCACABwGIBwCgB0CqBwcxNzk5NjcyugcPCAAQABgAIAAwADiiCkAAyAeykAXSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB8PWZIoIAhAA&s=de97a5fef085bab049507b0190a0c90711493637&type=pv&jm=1320|1003&px=0&py=974&bw=400&bh=225&sf=1&sid=7737516261924475700&vd=ct~0|rr~5&sv=221&tv=vh2-132&ua=chrome52&pl=win&x=video&cd=25&ft=0
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/video/221/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:33 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
e2e3b6da-7ab2-4176-95fe-b15e47358cf0
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
abt
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:35 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lX...
pr.ybp.yahoo.com/eng/4/imp/ Frame 1A0D 		0
126 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/eng/4/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:37 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
dc_oe=ChMI3puAtN6_9AIVfOq7CB2OPQO8EAAYACCUvoVI;met=1;ecn1=1;etm1=0;eid1=960584;
ade.googlesyndication.com/ddm/activity/ Frame 1A0D 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI3puAtN6_9AIVfOq7CB2OPQO8EAAYACCUvoVI;met=1;ecn1=1;etm1=0;eid1=960584;
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:37 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
aq
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/aq?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:36 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
v2
ams1-ib.adnxs.com/vast_track/ Frame 42CC 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams1-ib.adnxs.com/vast_track/v2?info=agAAAAMArgAFAQkK6qVhAAAAABFN2FLvE44pehkJ6qVhAAAAACCU5e6SASgAMJ8XOOc3QMyyYUjD6pcCUJ-ZpQhYvY0HYgJHQmgBcAF4AIABAogBAZABkAOYAeEBoAEAqAGU5e6SAbABAQ..&s=7c5eb20315d533ef6dec8ea58f0da25caec2c6b6&event_type=5&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:37 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
ddbbe650-69de-4235-ad56-359578b6590a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
st
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:40 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
dc_oe=ChMIn4qitN6_9AIVQwHTCh2Qrga_EAAYACCxr8xMQhMIyL2-s96_9AIVice7CB2IYQtb;met=1;&timestamp=1638263320542;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 2AD8 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIn4qitN6_9AIVQwHTCh2Qrga_EAAYACCxr8xMQhMIyL2-s96_9AIVice7CB2IYQtb;met=1;&timestamp=1638263320542;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lX...
pr.ybp.yahoo.com/eng/5/imp/ Frame 1A0D 		0
126 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/eng/5/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:43 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
dc_oe=ChMI3puAtN6_9AIVfOq7CB2OPQO8EAAYACCUvoVI;met=1;ecn1=1;etm1=0;eid1=18;
ade.googlesyndication.com/ddm/activity/ Frame 1A0D 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI3puAtN6_9AIVfOq7CB2OPQO8EAAYACCUvoVI;met=1;ecn1=1;etm1=0;eid1=18;
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 09:08:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
aq
capi.connatix.com/tr/ Frame 42CC 		0
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/aq?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.133.209.138 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-133-209-138.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://threatpost.com
date
Tue, 30 Nov 2021 09:08:42 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
v2
ams1-ib.adnxs.com/vast_track/ Frame 42CC 		0
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams1-ib.adnxs.com/vast_track/v2?info=agAAAAMArgAFAQkK6qVhAAAAABFN2FLvE44pehkJ6qVhAAAAACCU5e6SASgAMJ8XOOc3QMyyYUjD6pcCUJ-ZpQhYvY0HYgJHQmgBcAF4AIABAogBAZABkAOYAeEBoAEAqAGU5e6SAbABAQ..&s=7c5eb20315d533ef6dec8ea58f0da25caec2c6b6&event_type=6&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 09:08:43 GMT
X-Proxy-Origin
89.238.142.215; 89.238.142.215; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
043b9948-aade-4dc5-819c-79048916601c
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lX...
pr.ybp.yahoo.com/eng/15/imp/ Frame 1A0D 		0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr.ybp.yahoo.com/eng/15/imp/jIk8YfMmNoFR26aYCsHBOt7EVVth_VdNW-8bS6F0UspMRjDjO5fEU03nzsfZNLyIzHm2Lb2P-ueDgoQB_zVwwq7NooU0PCIESg3LEytpMRE_w-_igJDUHaqaxT1LcPzE8uSdN58PlkIxmN_syQQVnZhREQRCLnx8SgR_3EBRtOyvTyINvy_qps4up9ORy2xjWb3lXcsD7IZhn1zI3HJ1lXogfQhw5e9BDalM4y067EaxWai4m8KUiGYoUzVVcsahW4AY7yheHDWDH_AUzNxvKMmxVR-JfU6c3JFJYnrMIrGdyhSfDlwOLE4yHEUmmpXJccz2Ks-XSgEoD0IBZtRKJkY5qqLMJBFKDphgnGgpMJhK4PC3CQHYzzzY3rexRWKKkjnWwTQGmet3sajRwgamEZ7jDzi4RLvMzgjg9xaKM-XU29gbjWNbKuH9V_ZPVuFzlURRcriuUlAtJ1pK_SXEvtiBBn4s0icHrvWFF8KhcWOuMbYKPE9g-kcjuPtp23ZbG6rYP7Id6b6rCeYd1VtPrAyv25F98pC7faVQ8qo01k0EV1XKixeWCtS84mdb02zlMaHOWfYhmOmvDZGoR1FVcf9WLNwUevNhXcTfedOzdD7BV3NEZ6n__TnSg2pwVdlgucjFxoIynwNKBUvGVVc4QoXhoffn3rHycY4zZ5u2jmNEWqR7_d9jZ8A934Apakf-5T3qx6HX8nyUY-ON1NOLFeRhfaHfAJ8VQiiw4p3HOs8gNdZJEfv2iaBdNTHxx9_MOSOHvWQ5ncPxX8CRMV5LtsqyiQlz4RaVZwd_6sRQGSfhG4wenEcy6Mg9sOqAk6JfyN3O2eMCLD3YCig85W_FzvJxh6ptQQWyqtnUAUcG9V53DXsgH42ol0cQFofIxQWkDd_Axjwpx_I9JNnfchLkihF2qiD5_iWi1oR90Hi0UIhS18n-tuh2vd9i9QmZmR7XnT_teceA4AmnobABOErXj4gDamUlcDtjgBJOZr96rB51vvxTcg1Ufef1kcOMFPaM_NMjSYNXB6kG4XznqTL-RFPvaZpgUDCB-57gh00_Yrg6bWlj20UnAmpr_lZpekFYezc7V31pf2-TWWGDjaL8XKqC_bjVcKFuq3wkL3GI3xr-LVbBDcy9iDwEtCW--n6JneqcIRyX1HDlG_YUYrZyPDT-2doyW5N3zilE5ByQrYQEH-z9zXT3bWN-DPtKS7pc_J709xZoeLWPXZFfmk_iw2r6fFsB091N1qHzJoGqPCn4zeJ5yib08UDOEhk0Gt-PBv5O1odgO3q5Rb2Z27pvBiJvUA3VRE2wMgGdTL1ncWUcn2fsRWB0FeT4aNEJSHAK9gZCePLicWqngPjPeGSb21XmLYF6e1lmkg8OovAqYFMZQOmIPUuAOPMnwXqYwXmN5WKf9G1seaL_aqORkpRAFBmxpPx86KhbSw02U5Tf7gKs54af8wAGuWarlP6HwQ7KIP1vV61jOX-YDdCMwsT8ya7smSTZnx2xSszrLnuzALHDlTnJ22e1RYTdJBxLluuxjfpJYaJ0SWP1OEnrIEtDcGog0VcYcs4mVM2706EmDqMSrtbb4cQ4ZUOL26_h860ogPLDFgk6c0AA_rh_qTOubmPLOrC7pWHrPcOBKCghn4avVqeHCUcC7huaYJ8zOyJV_C_7Ogxdi-rToL60f2D3TrLsseRpvPt4sJ0ff704BEH3SAIQdIb9GMPabquDbw0tyWu4y5FaXwlQMJno7TDKRNcIkUvOi2c6_WFTJEQGnADUrVj-sTk6IWOKkW6WBtZM5fy88U1puE2hYEASBlNs-YBp44fKStDP5vLyEygg_M8SeOIJZwBcy2WVHwLSlxe4CVwjGGXwLYh5wh3PerSzVdn5mDCA12BYXSdDJwWAX8SOzRoLJG5sNA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:800::7001 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 09:08:45 GMT
referrer-policy
no-referrer-when-downgrade
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
public-key-pins-report-only
max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8="; pin-sha256="Gtk3r1evlBrs0hG3fm3VoM19daHexDWP//OCmeeMr5M="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="; pin-sha256="SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4="; pin-sha256="UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="iduNzFNKpwYZ3se/XV+hXcbUonlLw09QPa6AYUwpu4M="; pin-sha256="lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-xss-protection
1; mode=block
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
c.amazon-adsystem.com
URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthreatpost.com&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef
Domain
ib.adnxs.com
URL
https://ib.adnxs.com/ut/v3/prebid
Domain
tempsyncurl.com
URL
https://tempsyncurl.com/
Domain
token.rubiconproject.com
URL
https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
Domain
token.rubiconproject.com
URL
https://token.rubiconproject.com/token?pid=2249&pt=n

Verdicts & Comments Add Verdict or Comment

311 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler string| gAMP_urlhost string| gAMP_urlpath string| gAMP_urlquery string| gAMP_contentid string| gAMP_category string| gAMP_contenttags number| kPrebidTimeout number| kRefreshPollTime number| gRefreshCount number| gOXRefreshCount boolean| gRefreshDebug boolean| gPrebidDebug boolean| gTrackVisibility boolean| gLazyLoad boolean| gTrackPageVisibility number| k30SecondRefreshInterval number| k60SecondRefreshInterval number| k90SecondRefreshInterval number| k120SecondRefreshInterval number| k180SecondRefreshInterval number| k999SecondRefreshInterval number| kDoNotRefresh number| kDefaultRefreshInterval object| gSChainNodes undefined| gGDPR_forceLocale boolean| gGDPR_silentNoConsent boolean| gGDPR_forceNoConsent object| gGDPR_NonTCFVendors string| gGDPR_publisherCountryCode string| gGDPR_logoURL string| gGDPR_privacyPolicyURL string| kAmazonPublisherID object| ad728x90ATF object| ad300x250ATF object| ad300x250ATF2 object| ad728x90ATFTAB object| ad728x90STICKY object| ad300x250ATFTAB object| ad300x250ATF2TAB object| ad320x50ATF object| ad300x250ATFM object| ad300x250ATF2M object| ad2x2skin object| adGoogleAdXInterstitial number| gBrowserWidth object| desktopAdUnits object| tabletAdUnits object| mobileAdUnits object| gAllSlotData number| gAllSlotCount function| _0x10e398 object| gRefreshSlots object| gRefreshIDs object| gRefreshTimes object| gRefreshIntervals object| gThisRefreshIDs object| gThisRefreshSlots boolean| gInitialLoad object| gIntersectionObserver object| gPBJSTimeoutTimer object| gAmazonSlots object| gAmazonBids boolean| gAmazonBidsBack boolean| gPrebidBidsBack object| googletag function| _0x306c object| pbjs function| _0x5af4 boolean| gHasGDPRCMP object| gGDPRTCData function| amp_getBidsForAllChannels function| amp_dumpBids function| amp_dumpWins function| amp_dumpTable function| amp_getBestBids function| sendAdserverRequest function| checkIfAllBidsBack function| amazonBidsBack function| pbjsBidsBack function| bidsTimeout function| scheduleConsentUpdates function| sendBidRequests function| doSendBidRequests function| amp_refreshAllSlots function| amp_refreshSlots function| refreshAdSlots function| attachCloseBoxSVG function| configureAdSlot function| getCookie object| apstag function| cnx function| $ function| jQuery object| gdprDynamicStrings object| kss object| gdprStrings object| sNew object| s0 object| dataLayer boolean| jQueryMigrateHelperHasSentDowngrade object| cnx_usr_storage object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| __uspapi function| __uspOpenUI object| diHIpE2 function| diHIpE3 object| xop object| ggeac object| google_js_reporting_queue boolean| apstagLOADED object| google_tag_manager object| FontAwesomeConfig object| ___FONT_AWESOME___ function| __tcfapi object| __cmpAPI object| __GVL object| __cmpTCModel function| __cmpOpenUI function| pbjsChunk object| _pbjsGlobals object| ADAGIO string| nobidVersion object| nobid object| google_tag_data string| GoogleAnalyticsObject function| ga object| _qevents function| twq object| gf_global function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile object| _gformPriceFields undefined| _anyProductSelected function| gformIsHidden function| gformCalculateTotalPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRoundPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformToggleShowPassword function| gformToggleCheckboxes function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformToggleIcons function| gformAddRepeaterItem function| gformDeleteRepeaterItem function| gformResetRepeaterAttributes function| gformToggleRepeaterButtons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| GFMergeTag function| GFCalc function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format object| gform undefined| __gf_keyup_timeout function| renderRecaptcha function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar object| gfMultiFileUploader undefined| __gf_timeout_handle function| gf_apply_rules function| gf_check_field_rule function| gf_get_field_logic function| gf_apply_field_rule function| gf_get_field_action function| gf_is_match function| gf_is_match_checkable function| gf_is_match_default function| gf_format_number function| gf_try_convert_float function| gf_matches_operation function| gf_get_value function| gf_do_field_action function| gf_do_next_button_action function| gf_do_action function| gf_reset_to_default function| gf_is_hidden_pricing_input object| Placeholders object| kasperskyDynamicaReCaptchaData object| recaptcha object| L9c1kF function| L9c1kU function| xblacklist object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| jQuery112403600113223087913 object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| wp object| gf_form_conditional_logic string| gf_number_format function| do_callback object| MZ1D6o2 function| MZ1D6o3 function| xblocker object| player_instance_e6d7f682a0d84376ba56e19958a7046e object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| cnxPlugins undefined| google_measure_js_timing object| google_reactive_ads_global_state function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| gaplugins object| gaGlobal object| gaData object| twttr function| cnxProxyTask number| google_global_correlator object| closure_lm_201577 object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| sas object| apntag object| _ADAGIO object| GoogleGcLKhOms boolean| DFPSFMessageEnabled object| ampInaboxIframes object| ampInaboxPendingMessages object| ONFOCUS object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| DOMlessLLDcallback_52088558 object| BrandSafetyNadoscallback_52088558 object| google_image_requests object| anxVVAPICache object| _lntvideo number| lnt_z object| anxVVAPI object| xdrViewApi function| cnxAddEventListener

145 Cookies

Domain/Path Name / Value
.3lift.com/sync Name: sync
Value: CgoIgQIQrprpgNcvCgoI4gEQrprpgNcvCgoI5gEQrprpgNcvCgoIhwIQrprpgNcvCgkICRCumumA1y8KCQg6EK6a6YDXLwoJCAsQrprpgNcvCgoIjAIQrprpgNcvCgoIzgEQrprpgNcvCgkIXxCumumA1y8=
i.liadm.com/s Name: _li_ss
Value: MgkI_____wcQ_xA
.threatpost.com/ Name: _ga
Value: GA1.2.1305287818.1638263305
.threatpost.com/ Name: _gid
Value: GA1.2.1269496969.1638263305
.threatpost.com/ Name: _gat_UA-35676203-21
Value: 1
threatpost.com/ Name: _pbjs_userid_consent_data
Value: 6683316680106290
.threatpost.com/ Name: _pubcid
Value: 91b9888f-14db-4f72-9384-625b48a25151
.twitter.com/ Name: personalization_id
Value: "v1_XAsK0osYiyeyYHuMAd5QDw=="
.quantserve.com/ Name: mc
Value: 61a5ea09-ef1d3-0b909-05069
.openx.net/ Name: i
Value: 91b9888f-14db-4f72-9384-625b48a25151|1638263305
.threatpost.com/ Name: __qca
Value: P0-1060906429-1638263305420
.lijit.com/ Name: ljt_reader
Value: b6671e3b1468cdefc62a5f06
.rubiconproject.com/ Name: rsid
Value: 1|AIfsdBUO++vuGxiryvYpOSLvtIJhcvfF0nA/IpXwOAx8wdmULGiwCKqTCqCL5+nLKRys2mj2YQuneRSLAnarFwv0pGxR1B1frC9mOYGNEHIhzDz6TM9fU6s=
e.serverbid.com/ Name: azk
Value: ue1-sb1-8ecf4806-03ea-48a6-ad1d-73a7cf8ee57c
.rubiconproject.com/ Name: khaos
Value: KWLVO99D-W-87ZX
.rubiconproject.com/ Name: audit
Value: 1|naVuGyos1qptxH4nO7/l2FqbBgMWySGKoH1GQZR6kuhciWGKGc5rSBs+MRrcfRQZazGDAnZkjgciW6Q58jarRAvAG15loFpV9ffqWu8FjBY=
.adnxs.com/ Name: icu
Value: ChgIzLJhEAoYASABKAEwitSXjQY4AUABSAEQitSXjQYYAA..
.adnxs.com/ Name: uuid2
Value: 1130723691766142237
prebid.a-mo.net/ Name: __amc
Value: 1_1638263306_1638263306
.a-mo.net/ Name: amuid2
Value: 430cfaba-49db-418d-9caf-960d8e2e9748
threatpost.com/ Name: cto_bidid
Value: EqqZs19GWTNteldhUEFBNG9RazBMZmRsUVkxYmZwTmRRSHVqMVRoZEpqbUlYJTJCM1ZzUlJMamdvdHpLRnBiTG5IcGZ5R3g4RFR4ZHpVWGNXQ0pvc0hvQUxza21RJTNEJTNE
threatpost.com/ Name: cto_bundle
Value: kAmybF85RGpqa2FrNVIwdmtERk9UUmNhRDkzR2dEYkh4STQ0VFQ2ZUolMkJERzdEMklYYnhjdXJJUkMyNDc1TVQlMkZpRWNXTGdtcHREc2ZIUmJFUFlGbWFCUEtzdFpYcWNrR0I4T3pyREViTFdJUVdITGtyaHFrbEtyYmpiak16bjk2ZnMwNGs
.threatpost.com/ Name: __gads
Value: ID=6f96e43cee95e30f-22f8a5cb16cc0003:T=1638263306:S=ALNI_MaMMsvstGLA9EgC28AYfeQhtwgXjQ
.doubleclick.net/ Name: IDE
Value: AHWqTUlBAqLS4T_-AdoT-N6TlhssNhaA19KlIfbJkDiLcRhiE6Q1pLvD0sZWgD96aaU
.advertising.com/ Name: APID
Value: UP15d71b0a-51bd-11ec-ae5e-020c4429675e
.adsrvr.org/ Name: TDID
Value: baec76b8-1fae-471f-8226-e5fbe7c59c0c
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YaXqDQAIZSEhowBR
.casalemedia.com/ Name: CMPS
Value: 700
.casalemedia.com/ Name: CMID
Value: YaXqDmdMgARsAxdRjdxjjQAA
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2C$KeZRd#!]tbd8i_iqf!oN/@E'zz<*Z0QexlVrN?H)=_R>8vW8j.)=ck]%bQS3s2*<oz/X%W#.wL4W1Qw0wo>z?0
.casalemedia.com/ Name: CMPRO
Value: 1821
.yahoo.com/ Name: A3
Value: d=AQABBA7qpWECECupJ7G3crfOj3rMSbMLw1AFEgEBAQE7p2GvYQAAAAAA_eMAAA&S=AQAAAuHanP93cnE12ABkXtiDJQc
.mathtag.com/ Name: uuid
Value: f0a061a5-ea0d-4f00-a403-cf47764996bb
.yahoo.com/ Name: APID
Value: UP15d71b0a-51bd-11ec-ae5e-020c4429675e
.pubmatic.com/ Name: KADUSERCOOKIE
Value: E461FCB8-9678-4565-B13D-1B260BE3F7B9
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 1
.pubmatic.com/ Name: pi
Value: 156858:2
.pubmatic.com/ Name: DPSync3
Value: 1639440000%3A219_201_197%7C1638316800%3A174
.pubmatic.com/ Name: SyncRTB3
Value: 1639440000%3A220_21_13_161_7_56
.adform.net/ Name: C
Value: 1
.adform.net/ Name: uid
Value: 834006166056631821
.simpli.fi/ Name: suid
Value: 89826316FD594721B7F44E0BE3B1CA45
.acuityplatform.com/ Name: auid
Value: 626567909448
.pubmatic.com/ Name: PUBMDCID
Value: 3
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNjU0MTI2NjM3tLA0NzAxtDA0MRDiM9RN98tKM823rCgvKXWV4jU0M7YwMjM2NjSwMDMGAMvHNw80AAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNjU0MTI2NjM3tLA0NzAxtDA0MRDiM9RN98tKM823rCgvKXUFAAK9nsglAAAA
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESEKuL86I8gGE-ASYitiQTKYc&KRTB&16514-CAESEKuL86I8gGE-ASYitiQTKYc&KRTB&23025-CAESEKuL86I8gGE-ASYitiQTKYc
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:f0a061a5-ea0d-4f00-a403-cf47764996bb&KRTB&16736-uid:f0a061a5-ea0d-4f00-a403-cf47764996bb&KRTB&23019-uid:f0a061a5-ea0d-4f00-a403-cf47764996bb&KRTB&23114-uid:f0a061a5-ea0d-4f00-a403-cf47764996bb
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-834006166056631821&KRTB&23263-834006166056631821
.doubleclick.net/ Name: DSID
Value: NO_DATA
.de17a.com/ Name: guid2
Value: 1.1361929279369711967
threatpost.com/ Name: usprivacy
Value: 1---
.pubmatic.com/ Name: KRTBCOOKIE_336
Value: 5844-1361929279369711967
.pubmatic.com/ Name: PugT
Value: 1638263310
beacon.lynx.cognitivlabs.com/ Name: UID
Value: 8c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe
.onaudience.com/ Name: cookie
Value: 976b10171d0fb63d
.onaudience.com/ Name: done_redirects161
Value: 1
.exelator.com/ Name: EE
Value: "529534b7feba3bab8cb34c8a46e6703d"
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQcHUyNLU2CTJPC01KdE4KTHJIjnJ2CTZItHELNXM3MA4ZXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq0yNJsSX5RZvoid6fFRSlpDItKik8F79vBCwCc1CpM"
.openx.net/ Name: pd
Value: v2|1638263309.2|kiiygevNgun0.gqsLommOnsgi
.lijit.com/ Name: ljtrtbexp
Value: eJxlkEESAyEIBP%2FiOQcQFMjXUvn7Vsxe6D02as%2FgZ%2Bh467Y0r1B9jb0Pl8esH8%2BO1jG08xLBRAUv%2Fv7MnXrOEVBV8ZgknOiYyEi0TAcvMH1oMOkrNET%2BvHc02etw9J0NeQ6%2Fw79wf%2FE%2FpDf8Xs1dXEY%3D
.3lift.com/ Name: tluid
Value: 11519440181938250207
.servenobid.com/ Name: pid_312
Value: 1130723691766142237
.servenobid.com/ Name: pid_324
Value: 5142336718970418140
.w55c.net/ Name: wfivefivec
Value: uotbja5c1MRZ7N5
.gumgum.com/ Name: vst
Value: e_593e0f56-57f2-437d-8d59-8add6b779ffc
.smartadserver.com/ Name: pid
Value: 2716751734794748949
.bidswitch.net/ Name: tuuid
Value: fab7c4a6-2a45-4e9e-8d31-621eb4f79233
.bidswitch.net/ Name: c
Value: 1638263311
.bidswitch.net/ Name: tuuid_lu
Value: 1638263311
.mfadsrvr.com/ Name: tuuid
Value: b57f3c75-9f18-41d4-85b3-bee7f9b0b921
.mfadsrvr.com/ Name: c
Value: 1638263311
.mfadsrvr.com/ Name: tuuid_lu
Value: 1638263311
.lijit.com/ Name: _ljtrtb_273657
Value: 273657
.adx.opera.com/ Name: UID
Value: 120aed8e719542799dc432ba4fdbe242
.lijit.com/ Name: _ljtrtb_43
Value: Uy24nQB96ZFIeb-ZAS_0mAcl6ZFILOyYUyWEd0tv
.lijit.com/ Name: _ljtrtb_3
Value: f0a061a5-ea0d-4f00-a403-cf47764996bb
.crwdcntrl.net/ Name: _cc_dc
Value: 1
.crwdcntrl.net/ Name: _cc_id
Value: 771919e7d17ffd103da5ab588dafe287
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmNQMDc3tDS0TDVPMTRPS0sxNDBOSTRNTDK1sEhJTEs1sjBnAILEpa%2F4QTQUAABcKwsh"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBIXPqKH0hBAQAZXgIA"
.lijit.com/ Name: _ljtrtb_1
Value: 3239295199777413054
.w55c.net/ Name: matchopenx
Value: 5
.bidr.io/ Name: bitoIsSecure
Value: ok
.servenobid.com/ Name: pid_327
Value: 430cfaba-49db-418d-9caf-960d8e2e9748
.bidr.io/ Name: bito
Value: AAE4lk7DS9QAACwML0ARqQ
.bing.com/ Name: MUID
Value: 2F5228E1BD75622438B7381EBC206380
beacon.lynx.cognitivlabs.com/ Name: ss
Value: Akae252RmlKXNmHywvVa9wVvE0NkcFGGXUPpoY1ZuljNm8lYbYvURK1X%2BffqOihX4KJ0hu9qdTw535gG8YIuHg%3D%3D
.servenobid.com/ Name: pid_310
Value: b6671e3b1468cdefc62a5f06
.mfadsrvr.com/ Name: ssh
Value: !sovrn,1638263311
.lijit.com/ Name: _ljtrtb_5001
Value: 771919e7d17ffd103da5ab588dafe287
.servenobid.com/ Name: pid_317
Value: 2716751734794748949
.lijit.com/ Name: _ljtrtb_85
Value: AAE4lk7DS9QAACwML0ARqQ
.servenobid.com/ Name: pid_333
Value: YaXqDmdMgARsAxdRjdxjjQAABx0AAAIB
.servenobid.com/ Name: pid_309
Value: e_593e0f56-57f2-437d-8d59-8add6b779ffc
.adsrvr.org/ Name: TDCPM
Value: CAEYASABKAIyCwiM6LXm9vqZOhAFOAFaBmd1bWd1bWAC
.360yield.com/ Name: tuuid_lu
Value: 1638263311
.360yield.com/ Name: tuuid
Value: 36bf10a9-a68b-4c32-b9b3-8d7a561f0f85
.turn.com/ Name: uid
Value: 3239295199777413054
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAADvEyGtoZmxhZGZsbGhkYGLxC4lvYGFmskoMwTe0NLc8JY7EN7M0AQASz9NuQAAAAA
.postrelease.com/ Name: opt_out
Value: 1
.quantserve.com/ Name: d
Value: EGsBHAHsJIqsMK67gQn0Cfkg
.lijit.com/ Name: _ljtrtb_12
Value: 1130723691766142237
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003%22%7D
ads.avct.cloud/ Name: uuid
Value: 53796c53-a8e5-4a26-ac1e-9424f8b6f92c
.casalemedia.com/ Name: CMST
Value: YaXqDmGl6hAA
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqAOPqNdXNlck1hdGNoaW5nSWTQkWxhc3REcm9wVGltZU1pbGxpcyUBPlwDJE+OmGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAT5cAyRPjo90aGlyZFBhcnR5VXNlcklkIfuBMjf6QiS2QyUBPlwDJHeMRCUBPlwDJHeMRVdiNjY3MWUzYjE0NjhjZGVmYzYyYTVmMDb7+4Z2ZXJzaW9uwvs="
.creativecdn.com/ Name: ts
Value: 1638263312
.creativecdn.com/ Name: u
Value: FtmPq0W5wKG8DnOE0zfx
.casalemedia.com/ Name: CMRUM3
Value: c361a5ea0f2760av-99c6a6b4-33e7-474a-8ca7-31ce588ad3f8&8261a5ea0fa8c0&ce61a5ea0e05a0&0561a5ea0f05a0&2761a5ea0e0b40&e661a5ea0e2760&bf61a5ea0f05a0&0361a5ea0f05a0&4961a5ea0f05a0&b061a5ea0f05a00&f161a5ea0e05a0&2e61a5ea0f05a0&2d61a5ea0f2760CAESEMSTiDBVR0l1oRI6kAMFh0M&0861a5ea0f27608c81e7b0-e9a1-44e1-bd9d-9c0ab91683fe&0461a5ea1027603239295199777413054&0a61a5ea0e2760626567909448&3961a5ea0e27605142336718970418140
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&fdb44a0c-ff6d-4e7d-840b-a439214b3f2d"
.linkedin.com/ Name: li_gc
Value: MTswOzE2MzgyNjMzMTI7MjswMjEG4/aBoM3OzPgQSFg1yJqgUweEp66gkUXo36Oayiytpw==
.linkedin.com/ Name: lidc
Value: "b=VGST03:s=V:r=V:a=V:p=V:g=2464:u=1:x=1:i=1638263312:t=1638349712:v=2:sig=AQFVlnAAZG54NZJUDA1Xkh_P-O3ylP6k"
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 9105abb81090d4e3
.creative-serving.com/ Name: tuuid
Value: 98d76fa9-5328-4570-b396-d13f5c3fbb99
.creative-serving.com/ Name: c
Value: 1638263312
.creative-serving.com/ Name: tuuid_lu
Value: 1638263312
.mathtag.com/ Name: mt_mop
Value: 9:1638263311
.owneriq.net/ Name: si
Value: Q6915497121270947050
.owneriq.net/ Name: p2
Value: sv
.technoratimedia.com/ Name: tads_uid
Value: GDPR
.servenobid.com/ Name: pid_321
Value: RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003
.amazon-adsystem.com/ Name: ad-id
Value: A9Zd5ohtH01Lg3eexlY0Ce0
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.lijit.com/ Name: _ljtrtb_49
Value: h2HhD6496tI5
.nrich.ai/ Name: _nauid
Value: 8745dc56-754a-4b93-98ae-0fa50d57708c
.outbrain.com/ Name: obuid
Value: 08d78e69-8710-4bd8-bc10-c931ca5a9516
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-5bb60842-c657-42ec-7e6c-cc082bd2a647.DEHw%2BHM6U2uR6tVmSqQrQoTINe2m1ZGBIyZslWDfyHU
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A0-5bb60842-c657-42ec-7e6c-cc082bd2a647%24ip%2489.238.142.215.Bdd39%2FoJInNQpcAm7vW%2B0lJyIluClIZIx9Jg3LXAbgU
.ipredictive.com/ Name: cu
Value: 175136f7-51bd-11ec-91c0-1b27083715d9|1638263312351
.smartadserver.com/ Name: csync
Value: 76:CAESEAkZyRD-gwLg6NlHcFX7jio|86:1130723691766142237|127:AAE4lk7DS9QAACwML0ARqQ
.go.sonobi.com/ Name: HAPLB5G
Value: s578|YaXqE
pool.admedo.com/ Name: c
Value: 1638263312
pool.admedo.com/ Name: tuuid_lu
Value: 1638263312
pool.admedo.com/ Name: tuuid
Value: b705a7be-a449-4530-aad1-68df0e501ffb
.lijit.com/ Name: _ljtrtb_86
Value: FtmPq0W5wKG8DnOE0zfx
.analytics.yahoo.com/ Name: IDSYNC
Value: "187s~21tl:17ot~21tl"
.yahoo.com/ Name: APIDTS
Value: 1638263312
.zemanta.com/ Name: zuid
Value: lwCPDZZPoXDoqqAGvDcZ
.lijit.com/ Name: ljtrtb
Value: eJwtjl1LAzEQRf9LnhuYr2R2fEtrBaFStqUU%2B1Kym82LVRBEWaT%2F3Sz4NodzuXd%2BHboHx8RGFtBMVQUZgriVQ2oKGylxNNQYUYhYm%2BJmKmSImIOfMhQvFcBnAfZjFdUoZnEYWjQALBOqaGiTFtRaCwKXHPIQuq7kOlG3lJJyDNqy%2F8fKdaFRSlu5venj0fqUNj8vO0iHz75ZWb44zSQf%2Fdri5el5GvwlHa%2Fwnsbbwrv9%2FHqaz9sCX9%2Fu%2FgeGfDnG
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-45f3151b-1d61-4bf6-8195-425696e1ec5e-003%22%2C%22nxtrdr%22%3Afalse%7D
.pubmatic.com/ Name: SPugT
Value: 1638263312
.liadm.com/ Name: lidid
Value: 43874f65-4884-45ff-bf47-24695a16eea2
.outbrain.com/ Name: mediaforce_custom
Value: a83faa2b-448f-4307-9aa0-69172bcd385c

32 Console Messages

Source Level URL
Text
javascript error URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
Access to XMLHttpRequest at 'https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthreatpost.com&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef' from origin 'https://threatpost.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthreatpost.com&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
Access to XMLHttpRequest at 'https://ib.adnxs.com/ut/v3/prebid' from origin 'https://threatpost.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://ib.adnxs.com/ut/v3/prebid
Message:
Failed to load resource: net::ERR_FAILED
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/ikea-email-reply-chain-attack/176625/
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Message:
Failed to load resource: the server responded with a status of 400 (Request failed due to privacy signals)
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://t.adx.opera.com/pub/sync?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D335%26uid%3D
Message:
Failed to load resource: the server responded with a status of 400 ()
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
network error URL: https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Message:
Failed to load resource: the server responded with a status of 400 (Request failed due to privacy signals)
network error URL: https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Message:
Failed to load resource: the server responded with a status of 400 (Request failed due to privacy signals)
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://id.rlcdn.com/709414.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
network error URL: https://tempsyncurl.com/
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3e91d1fcbd6aa14f4ebeae72afa5ecee.safeframe.googlesyndication.com
aax-eu.amazon-adsystem.com
acdn.adnxs-simple.com
acdn.adnxs.com
ad.360yield.com
ad.doubleclick.net
ad.turn.com
ad4m.at
ade.googlesyndication.com
ads.adaptv.advertising.com
ads.avct.cloud
ads.creative-serving.com
ads.pubmatic.com
ads.servenobid.com
ads.yahoo.com
adservice.google.co.uk
adservice.google.com
ams1-ib.adnxs.com
analytics.twitter.com
aorta.clickagy.com
ap.lijit.com
assets.threatpost.com
b1sync.zemanta.com
bcp.crwdcntrl.net
beacon.lynx.cognitivlabs.com
beap-bc.yahoo.com
bh.contextweb.com
bid.g.doubleclick.net
btlr.sharethrough.com
bttrack.com
c.amazon-adsystem.com
c.bing.com
c1.adform.net
c2shb.ssp.yahoo.com
capi.connatix.com
casale-match.dotomi.com
cd.connatix.com
cdn.adnxs.com
cds.connatix.com
ce.lijit.com
choices.trustarc.com
choices.truste.com
cm.g.doubleclick.net
contextual.media.net
creativecdn.com
cs.emxdgt.com
d.turn.com
d5p.de17a.com
data.adsrvr.org
dmp.brand-display.com
dsp.nrich.ai
dsum-sec.casalemedia.com
dsum.casalemedia.com
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
g2.gumgum.com
gcdn.2mdn.net
geo.ipify.org
geo.moatads.com
gift-connect-d.openx.net
go.sonobi.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.liadm.com
i6.liadm.com
ib.adnxs.com
id.rlcdn.com
id.sharedid.org
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
imasdk.googleapis.com
img.connatix.com
jadserve.postrelease.com
js-sec.indexww.com
kasperskycontenthub.com
lit.connatix.com
loada.exelator.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
mb.moatads.com
media.threatpost.com
mp.4dex.io
mug.criteo.com
nep.advangelists.com
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.33across.com
pixel.advertising.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pm.w55c.net
pool.admedo.com
pr-bh.ybp.yahoo.com
pr.ybp.yahoo.com
prebid.a-mo.net
prebid.adnxs.com
pubads.g.doubleclick.net
public.servenobid.com
px.ads.linkedin.com
px.owneriq.net
qd.admetricspro.com
r3---sn-aigzrne7.c.2mdn.net
rb.adnxs-simple.com
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb.mfadsrvr.com
rtb.openx.net
rules.quantcount.com
s.amazon-adsystem.com
s.yimg.com
s0.2mdn.net
script.4dex.io
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
stags.bluekai.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.go.sonobi.com
sync.hgrtb.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.serverbid.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.teads.tv
sync.technoratimedia.com
t.adx.opera.com
t.co
tag.1rx.io
tagan.adlightning.com
teachingaids-d.openx.net
tempsyncurl.com
tg.socdm.com
threatpost.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
u.openx.net
um.simpli.fi
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
vid.connatix.com
www.google-analytics.com
www.google.co.uk
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
yahoovpaidtwoint215831825037.s.moatpixel.com
z.moatads.com
c.amazon-adsystem.com
ib.adnxs.com
tempsyncurl.com
token.rubiconproject.com
104.109.78.125
104.111.215.191
104.111.242.245
104.111.242.53
104.244.42.3
104.244.42.5
13.224.193.60
13.224.198.4
13.225.77.128
13.225.77.18
13.248.245.213
132.226.41.106
134.209.131.220
142.250.181.226
142.250.184.226
142.250.185.130
147.75.38.124
151.101.12.157
151.101.129.108
151.101.193.108
151.101.194.137
151.101.194.49
151.101.2.137
151.101.65.108
151.101.66.137
154.59.122.79
159.122.14.34
165.227.252.242
178.162.133.148
178.162.133.149
178.250.2.146
18.156.0.31
18.158.154.136
18.192.161.141
18.193.57.131
18.195.155.181
18.196.123.190
184.31.84.150
185.184.8.65
185.29.132.245
185.33.220.100
185.33.220.243
185.33.221.52
185.64.189.110
185.64.189.112
185.64.190.80
185.64.190.81
185.86.138.114
185.86.138.132
192.132.33.46
193.0.160.129
198.148.27.140
198.47.127.19
198.47.127.20
2.18.233.180
2.18.234.21
2.18.235.40
2.18.235.93
2.19.35.65
2001:678:cb4:bbbb::11
2001:678:cb4:bbbb::13
202.241.208.52
205.185.216.10
213.155.156.180
213.19.147.43
213.19.147.45
213.19.162.80
216.52.2.19
216.58.212.166
2600:1f18:444a:4602:b51a:2bef:14:5241
2600:9000:20eb:3200:6:44e3:f8c0:93a1
2600:9000:20eb:fa00:2:9275:3d40:93a1
2600:9000:21f3:8600:0:5c46:4f40:93a1
2602:803:c003:200::21
2606:4700:20::681a:8a9
2606:4700:20::681a:ad1
2606:4700:3030::ac43:cf70
2606:4700::6812:272
2620:116:800d:21:ee05:6a01:4b41:8c89
2620:119:50e5:101::9002:c05
2620:1ec:46::60
2620:1ec:c11::200
2a00:1288:80:800::7001
2a00:1450:4001:801::2002
2a00:1450:4001:801::2003
2a00:1450:4001:802::200e
2a00:1450:4001:803::2001
2a00:1450:4001:803::200a
2a00:1450:4001:809::2008
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:811::2003
2a00:1450:4001:813::2001
2a00:1450:4001:813::2004
2a00:1450:4001:813::2006
2a00:1450:4001:828::2002
2a00:1450:4001:82f::200a
2a00:1450:4001:82f::200e
2a00:1450:4001:830::2002
2a00:1450:4009::8
2a00:1450:400c:c00::9a
2a02:2638::1c
2a02:fa8:8806:16::1400
2a05:d018:d29:3601:ba88:8e4e:431:61be
3.10.67.38
3.124.10.167
3.126.16.11
3.133.209.138
3.210.4.50
3.228.133.61
3.232.127.49
34.210.233.105
34.225.96.147
34.249.15.20
34.254.143.3
34.255.38.72
34.98.64.218
35.156.121.212
35.157.246.167
35.173.160.135
35.179.78.10
35.186.253.211
35.210.53.219
35.241.40.233
35.244.159.8
35.244.174.68
35.71.131.137
37.157.4.29
37.252.161.190
37.252.167.215
38.91.45.7
50.19.13.13
50.31.142.159
51.210.112.236
51.255.68.171
51.89.9.254
52.16.229.21
52.203.137.199
52.211.212.107
52.215.102.174
52.3.139.221
52.46.130.91
52.59.85.35
52.95.119.178
54.36.109.22
54.77.19.59
54.84.15.237
63.33.204.129
64.140.160.2
64.202.112.159
64.233.184.154
66.155.71.150
67.202.105.21
69.173.144.138
69.173.144.165
72.251.249.13
8.43.72.97
82.145.213.8
014f2fb8d253cee4da7966e085bf836310d85793e5ab4291489a6add2b123e6a
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
0282fd1663bd83710f0b9e7f47496198d34ca63deb4c60ce0bcdd88be875bd57
02bb51e187485e1c631882cbe782a7786ea7f8ce585e7ae4b99bbb943945c0a0
038fc4d49a9191d416d49841f371b6e0b06bb40f719124099d40fe8f393b9e2c
03cc687f0c8a2d1694e509b91fcd6c62c0fbdbdbdb850b8007b8052f649c7f77
04c093e430826ca10880992c3b7a891c7a06acbb4689a6e3f7878d7271c4e934
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
0677254f4a0ea43f98f13acb5be0a4bc75c35f84fa3258a5b3b583400fd32fb6
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
0782733c5b6813af4d02fb3818a2aa92f713e37f4cd9a311f7df83217d316315
08f18aed76e9840c53872eebcf244a689dee2c942d1c299709a23015ef698e05
0a3699c8bdd78b075514392d4384b3e94c5c9e07fc1ff4e1501af45180463c47
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
157459c2040ec5edadc0c7da7f8573a887685b9d03c805f2d7bc71a5ff11e285
164f113713f0f15f300354fb36e2f2529e5d2f74c0b88ed714e745a277e4be02
1681cb2b2db935f48c843351945df3f3f77f79c1c8de28c4fa88d8b655c25ae2
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
19a7659a2a48aa5c299dee1ac14bc4d9a47f3be58010ae2ad753509a797d6b76
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2
1d5a65e5129df0b4c89e73f205c6cb89cba0cd1d8e21a1512ca76b769634052d
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4
211e301c21dbd59e8385d89e4dd5533d8dacf32ef8a918decb9d87e364ac9da8
225c29df4c703303a08e31089905ffedf5b3e50419468908176b8179a0e69d59
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
29dded85a6035878b3169ce914a487d322fc4522745876a722c0dea0e91c6c53
2a196af0bd6fcb154dc9e56868902b30be1deffcac0b48378c1b9cfd23beae37
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
31d5648df5eebdf3d492b355285870ced53b93143889c04edf9deb94357dd6e6
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
33276bcdad0da0460a5fffc12621ba9d2530b7dd3aa10033f57fb2235478df14
3461118e510cfe52c4a49e235e5a40b44827c51e3d08fbed0a5cad23860fdbdd
34d7bb2bbd510d29cad7fcf49e89b9f0c2443c09ccfe5b61cdc436522c4ed0ec
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
37aa3970b6801c9d286464f7d86e50bf41c88e54c7b4d08f3ff61935b3f59c3c
386fa8853d7a8c212833edc9522b523e0c0ab0790847fcd91021f5daefa1d170
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3a3fdb1f3bf800e3d6388a16866c63cfa164ed6f85823cfc3a726b785993e10c
3a906d42aaff31831323f59efb6087c53bc1a1e91ffd1472cc4dd689b1d6a32f
3b5bb1dd6c9ec6ba0bf39c35ed5a8934564df7f9555df7da742d3afa2da230b6
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3c25b077a6d92cd9d3576660b68c4c0bd135b78b3cd3b66491ff2c7aa0eeaad3
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3eee78aaf4f9dc8d0d36d3dddbaad9094ace5d91611f9aee6fe0b44b0ed46ccc
3f503cb02a2a8c63ce88a8ff414873033d7519b9166f8dbc488fed45c624bd54
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
42ed7aa3c5ae0a7364bc29f147c026511b05c3291ba385ef342982ef0ff3dc75
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd
4823c011e4b4cb4b7f35ced3ab09d57215ee243676d9bfcc24d10ec77d3db398
4862630c71a859f6e89b81c4f4565940de1c321bbbb21c697c25924b304e09f2
487fce51fd801415c362f3f9f2df43c445a4b9ba38f9b6d49dfc898dc85ede94
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e87b0833dbc4021d64216db82295cda42836ba949bbd077c29e6317a65faddf
4f5400d92abbf35b83ec1d310f710359807f149972ab1d541372def9cce9073a
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
4fab72dc8ea248c85dadc2fdf377ee56d24dc5c0a1dc87c24c1642702b8d228c
4fddec1cb13ee6848cce386a733d405fff2be9ab4d904f55a1d15c7cc84f410d
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
5130eb2b26589edc79df541561e0c40469fdb05a7a75566a61e580e1d473254e
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2
53fc57303cb2c4b4dd219016942c15e87b1d9bd29e5124b8a6d577ba89c7a92b
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54916830a4704382c31f6c87d03e342ad803979a09d3e4379283da814808e74d
57557fd3d6204ee05b9cf2ec6b7569991d33655a3cf51ce6bb1c356924ae01ca
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5bd347e9dae9ec34879d4efd95c533f3772e972964d47edceb1297c03e086805
5bec6f9dee779aa19f2b1dccf9e55296725d796fb39b3a4f0405e62cec1518ae
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
60dc86355a726817f9b9a0bf4504753a7c6c61e3bc7f6d9dbea1d101e76b015d
62f78842f130e9a3671d447bbd60f57049f10429fba72a424d724377a691237f
63c6baa33b668706ab50772748de9ae03e8d88b691a4e71c6dd656f203b860ab
651e04b0e5647f9e2913196fa892689f13772efe4636cc1bbdad48868f67e1ce
65445aacbafe7ae9e7c21a38e05b09e0b8af45eb6c11e4bd0a4816d836d016ca
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
66472652c9ad939bc6f65d6936479839c0eb3b1030e0aef80dd74d0c8fc4a47b
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c9a29d5877620bf729f6920b50466df6e2635d6cf6a7b3dd7bc7ec4f361bda4
6daa27fedbf78fddf32e3fdfada60642a83bb9b1bf4eb996e71f2010a9dd3861
71c6ea85dba250b22bc1baaa084572f76dcbb99cb2779e5a603aa867717889a6
71cec2485cdafd67b2aeffca3c58ccda458fcf5bf96bd01a2776348016f782c7
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4
745f534b16a94e23c3c4eed4fb75adc7244e9a472556c1b3cc0490a1518219ad
7b6ccb89ba648d507f400b5eba43427cb03126dfa77578b3f67922a49fc61017
7ba6ef89c5671ecd4d87c9db7d69c6297a2c7effbbde218210e9f05834ab34e4
7d242e71104487a2042b6038b55d7b7bf107756e956b97074077552914cb0ebb
7dd7b548955c22cf3c2d3c978dd4aa416822dc15a4f65ab019159d9da689c628
7de3b7a3cbd73581de843bf06eb79f0d9d98039140bdc72cf783693e98e0f167
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c
7f7a2dc8aba3c3e447f512c5db932f05241c1441b2188d87abf759b1a85295c2
7fd9983a3429d6ead1f66bf933770f9b790818b189e39ff0f2a0d3f590bbf67b
8015a89c7e50b71a6597cfc7bc2be462212ae1f57c37e40878a79e7550768ccd
807e17c9876120eae3192a036a1d509cb5c3094de970d7a30b83e9aaa0b90aed
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
86b3dce72c0a030f3fdf90546b371635abdf4ca8b78bc138057640af63109542
8854752a74f17180183321d2dba6179fda1d37cd626d436d2236dfb797e57fb8
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a8631e38e3fba962e873727e47a296556212b958b54b160ec8ef178d2563f37
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8c1fbf6716f852b0885fd2e921f0b1e5f2c8dd57e3fde17c297ba81f0fc77427
8c895754b308383c68611631c019bd62013416b37bcdf3e2d3f5ddf1c031151d
8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7
8d4b9633320f23d8ce3c4dcb514f76d27c6774115c5f699917dd94c3777a6ba7
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8db22950b3f47f686f4bad6b6d21386f03a4b0b24320c6715436424e41dcda09
8edaef698e025c37ba9e8d632a895d7252c62251df3f095d5cff17b6f3304854
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
90fb7f486363baac11225c229b7c82176fc1cb6549cae16dcb3e6e41a29857de
921c9a3b844ff84e61b3e608d67f365c32ee705e8681cc4edcaf9b979ae99c6d
923272d509c82dee64f700fd96330fbce677d0e1b12b2490f0efb37a5c08702f
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
96d9f58640c821cd2bc50aef63eb8f804d74c7fc9d38adccac99131affaa5eda
971782c1fb8c1616186dddf59b6427d9466ffe0ed7f1e060e11382952c878748
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a959dbaba9216a8be8a43b07caaad3f98fcf497125224b3785ed96f5d20e66f
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
9f0996ed0067396fee7b71b5b4c8b264f2c7edefa6cce07431184ae931c542e0
9fc98a5f2ad3fade2176c7f4d057c02a332ee5d3e532746414eda6e88bc46ae5
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a19736654ddf761ddee7392457d6fc5f2ce5c2e94c9e5d076d275d5f251a0a82
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a2d4f4b9bd1c70bd929d55b7cf4460eff853e9caee9ace228400c4e0c4d82b74
a355508d811ac666d1b61e566f7f1daf5d39b8915c036b271f14a4cfb9247ac3
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ad852ac5870565de6715d223dcfe2eb2d6aacd30ede4a4e1ef356cb3a62346b9
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
b126e085011449d4c30f74a325e37b19c7d0bc4b73a06b16c97dfa9ad98d3cd4
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55
b403518c7d5d2fb1f557ec8404d46d72e9eaf88389fd92fc75b8ec8438e719af
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b4c7705e3fb3524673ae02c21a55242d92724c6b62e3f3a0ad42fd124cb06dab
b813e47b551a74f55e504ad2e4a7fdb97ee55a9497486ffa61f4dfc34e6fd338
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb66dbe2867f4bd08186615c104fefef105858870dd23550d3fd33100115f4e9
bb942ff04c67c59bbe8b9be22036327d1564b588903c99d6f598390d6013588f
bbe4e4e4e847a32bd717d963f0ac04b619a7a9cdd631a7454d9dfec16fbae73f
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
be3ba2f86654b73dda7d39ed448c90628092498372215fffe2281e0b587a62dc
c08b7fca7d996af22d34e4132379beee7691e435c7859b6a717669b364889b3d
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c5175b5497c68d79183db6e5a431a038ebdbfddfe5571434a1ad43f2453351c5
c77abaa324e43b2ac70617309fb60582931602391e69484088fed7081f3b5483
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517
ca6937e42685b5d900a56805d80cbffbafdc9afe8005406697778f3ec1ce7be0
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
ccaf0448a586586e14ac4d5d046d363cf7902eb3ddeea41494ab702d29f0d2e9
cdf0abe24bcec26c606449634600434f84a6d826067060c32fcf824e92fc20e0
cecb2c2a724e47b0cfa0e322f06f4f3b3bb8704df277e114fefb38cca8f9b327
cf2879005763af69dc673fcb56a866d2a1ec6a638a6deaad1f91e1336086e91e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf4f9c30d0de5ac0f5670d7931f8e77aa743bf4e6a37d82b0bb488ed35b93bb2
d00c8b7e3ca5dff45a99c35859fa47ac7f74ce88c3ededc0e65664836109a21e
d0a193391736782d237ccd5863a121cdb6c6da890b399d92c51d537cffd83abc
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d0cc02919084686c517bcb7c35a4418920ac51eacddcf67e50bd5b55f1d78849
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d2998b11dcbfb3acff62edea1993a71590d7b67463d57d0a18a268978bd1297e
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d87bc257689ca319d79f6ea869dd7f94e90888d3697e0108c792f41f79c47f68
d957bd6a5deeb84b126f1aeea3a480684705dfae6c660f1acd822d71d5621092
db8deb30d5cecf873a6361b5410aed53a439e46072dcd6af4dc2481e44ea2a59
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd3b59893dd570ebb6432de87451873d9e32e1af2e8795296d0b163f16cdb980
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
de80309d98405d566c6fb1912811b24c8ad3a8380f6819d26a6c1eac5cd99185
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e02dccb1f7be4cd317a35d9931a57accaf6ae679bd70925fced8758c8a5d8d9e
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d59e547271d44343356cb9986a13476eb76bb068a8c0549b9e2ae255721f26
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389
eaddadb4dd24a0484fdda36517daec40d53cca4cf2d144329c97c0bedb50c8ed
eb0f49efa8636d3c10bce91d1babcb192373903c2cbb08f3ac52c1abdc0f9dee
ec64e6317144633c523be2052da645ca9973e87839fef4f3f0b29748d72dcedc
eca17adc307624155d47990253cd2372aa60b097ef0718af007616e4ae3b83e7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f6378ff18eb8324cba4838e6521c9d7203d289ca6cbe9caa8a992b56b8c55055
f63e14b637e1b3d523ac5fa3d716f0e7fcf4e0b1d5ba1c2d676ea83a1b89aad3
f68329f0d0fd84eb7dd073b8c297c1c5ecd584db4bb6e02eb50aaf7a5c440f3b
f6c82d319fe2b88dbb0cbb560ca58059b114344df3757d9dd53ae7afb7ac59d8
f71c80526dc54d8ca51c95af37b6c7c0039d4bc5b0bf47f27900d9311312becc
f7511f403bc5d8cdd240bbdb02c5848775e0f89f6dd952e70675d22fd434e1b4
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f821648812445031d5fa278d7ce7469bd8760ea5c1c4f023b9787536e49068f0
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
f9389b0641544c2777142c53a0f94e9e4053e1dac3c062f62cf81ba327445a63
f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a
ffdbea2a5a9959ea5f9809139a0178c725fa9474a88f1cfe10f702bdb35c3cc0