www.redpacketsecurity.com Open in urlscan Pro
2606:4700:20::ac43:4810 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/3tt2kxWiPY
Effective URL:
https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
Submission: On September 12 via manual (September 12th 2022, 2:23:58 pm UTC) from IT — Scanned from IT

Summary HTTP 283 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 26 IPs in 6 countries across 25 domains to perform 283 HTTP transactions. The main IP is 2606:4700:20::ac43:4810, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.redpacketsecurity.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 17th 2022. Valid for: a year.

This is the only time www.redpacketsecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
62	2606:4700:20:... 2606:4700:20::ac43:4810	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	2a00:1450:400... 2a00:1450:400e:800::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700:440... 2606:4700:440e::6812:2fe6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
4	149.154.164.13 149.154.164.13	62041 (TELEGRAM) (TELEGRAM)
19	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
2 34	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
9 17	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::181	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c07::9c	15169 (GOOGLE) (GOOGLE)
10	104.222.176.10 104.222.176.10	6762 (SEABONE-N...) (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A.)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
38	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
2 5	2620:116:800d... 2620:116:800d:21:de2e:c7b3:55c0:d5a0	16509 (AMAZON-02) (AMAZON-02)
2 2	52.48.82.83 52.48.82.83	16509 (AMAZON-02) (AMAZON-02)
32	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
7	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
7	198.47.127.19 198.47.127.19	62713 (AS-PUBMATIC) (AS-PUBMATIC)
6 6	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
8 8	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6 6	69.192.160.219 69.192.160.219	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
2 2	35.157.16.92 35.157.16.92	16509 (AMAZON-02) (AMAZON-02)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb	16509 (AMAZON-02) (AMAZON-02)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
283	26

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

62 2606:4700:20::ac43:4810 (United States)

ASN13335 (CLOUDFLARENET, US)

www.redpacketsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:400e:800::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:440e::6812:2fe6 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 149.154.164.13 (London, United Kingdom)

ASN62041 (TELEGRAM, VG)

comments.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.162 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany) 9 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.222.176.10 (United Kingdom)

ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT)

tg.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
oauth.tg.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

38 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:116:800d:21:de2e:c7b3:55c0:d5a0 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.48.82.83 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-82-83.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f194.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 198.47.127.19 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 69.173.144.139 (Frankfurt am Main, Germany) 6 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.18.19.126 (None, ) 8 redirects

ASN13335 (CLOUDFLARENET, US)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 69.192.160.219 (Frankfurt am Main, Germany) 6 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.16.92 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-16-92.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 73 stats.g.doubleclick.net — Cisco Umbrella Rank: 188 cm.g.doubleclick.net — Cisco Umbrella Rank: 303	225 KB
62	redpacketsecurity.com www.redpacketsecurity.com	1 MB
57	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 129 tpc.googlesyndication.com — Cisco Umbrella Rank: 174	586 KB
25	gstatic.com fonts.gstatic.com www.gstatic.com	322 KB
20	google.com 9 redirects www.google.com — Cisco Umbrella Rank: 19 analytics.google.com — Cisco Umbrella Rank: 640 adservice.google.com — Cisco Umbrella Rank: 142	3 KB
13	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 120	83 KB
10	tg.dev tg.dev — Cisco Umbrella Rank: 49215 oauth.tg.dev — Cisco Umbrella Rank: 49367	174 KB
8	casalemedia.com 8 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 709	8 KB
7	pubmatic.com image6.pubmatic.com — Cisco Umbrella Rank: 891	412 B
7	openx.net rtb.openx.net — Cisco Umbrella Rank: 2282	734 B
7	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 234	307 KB
6	addthis.com 6 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 3095	5 KB
6	rubiconproject.com 6 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 494	3 KB
5	quantserve.com 2 redirects cms.quantserve.com — Cisco Umbrella Rank: 1531	2 KB
4	google.it www.google.it — Cisco Umbrella Rank: 13881 adservice.google.it — Cisco Umbrella Rank: 43621	914 B
4	comments.app comments.app — Cisco Umbrella Rank: 299507	48 KB
3	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 885	764 B
2	agkn.com 2 redirects d.agkn.com — Cisco Umbrella Rank: 929	1 KB
2	mookie1.com odr.mookie1.com — Cisco Umbrella Rank: 1463	417 B
2	everesttech.net 2 redirects pixel.everesttech.net — Cisco Umbrella Rank: 5042	752 B
2	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 159 partner.googleadservices.com — Cisco Umbrella Rank: 972	1 KB
2	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1568	10 KB
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 2085	296 B
1	t.co t.co — Cisco Umbrella Rank: 600	560 B
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
283	25

	Domain	Requested by
62	www.redpacketsecurity.com	t.co www.redpacketsecurity.com static.cloudflareinsights.com
38	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
32	cm.g.doubleclick.net	googleads.g.doubleclick.net
31	googleads.g.doubleclick.net	2 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net
19	pagead2.googlesyndication.com	www.redpacketsecurity.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com t.co www.googletagservices.com
17	www.google.com	9 redirects tpc.googlesyndication.com googleads.g.doubleclick.net
16	www.gstatic.com	googleads.g.doubleclick.net
13	fonts.googleapis.com	www.redpacketsecurity.com comments.app tg.dev googleads.g.doubleclick.net
9	tg.dev	comments.app
9	fonts.gstatic.com	fonts.googleapis.com
8	ssum-sec.casalemedia.com	8 redirects
7	image6.pubmatic.com	googleads.g.doubleclick.net
7	rtb.openx.net	googleads.g.doubleclick.net
7	www.googletagservices.com	googleads.g.doubleclick.net
6	e.dlx.addthis.com	6 redirects
6	pixel.rubiconproject.com	6 redirects
5	cms.quantserve.com	2 redirects googleads.g.doubleclick.net
4	comments.app	www.redpacketsecurity.com comments.app
3	id.rlcdn.com	2 redirects googleads.g.doubleclick.net
2	d.agkn.com	2 redirects
2	odr.mookie1.com	googleads.g.doubleclick.net
2	pixel.everesttech.net	2 redirects
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.it	pagead2.googlesyndication.com
2	www.google.it
2	static.cloudflareinsights.com	www.redpacketsecurity.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	oauth.tg.dev	comments.app
1	stats.g.doubleclick.net	www.redpacketsecurity.com
1	analytics.google.com	www.redpacketsecurity.com
1	www.googleadservices.com	1 redirects
1	t.co
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
283	34

This site contains links to these domains. Also see Links.

Domain
twitter.com
t.me
n8n.io
www.patreon.com
discord.gg
www.reddit.com
www.linkedin.com
www.facebook.com

Subject Issuer	Validity	Valid
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-17` - `2023-06-17`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.comments.app Go Daddy Secure Certificate Authority - G2	`2022-03-30` - `2023-05-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.tg.dev Go Daddy Secure Certificate Authority - G2	`2022-04-08` - `2023-05-10`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.google.it GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-14`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-24` - `2023-03-27`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh

This page contains 32 frames:

Primary Page: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
Frame ID: DD3DBC1D1C4B2A7CB23BEA56B61E6BCF
Requests: 80 HTTP requests in this frame

Frame: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662984000
Frame ID: ABF8F058D13D3BBE9F7EBFC801F3B75A
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20190131/zrt_lookup.html
Frame ID: C337C7D4806A38E902DE63B511F00A15
Requests: 1 HTTP requests in this frame

Frame: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Cobalt%20Stike%20Beacon%20Detected%20-%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443%20-%20RedPacket%20Security&limit=5&color=E22F38
Frame ID: 3551519E3EB0256AAE3A56C2741EBEBA
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&adk=1812271804&adf=3025194257&lmt=1662862591&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630745&bpp=8&bdt=907&idt=345&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8234742624287&frm=20&pv=2&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=374
Frame ID: F92A88CBB2105D5447DF26B424ADBFB5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377
Frame ID: B2819DA3B519159B8DB998F813167442
Requests: 16 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F44DAB85E7F5787D6C06D1BD62EAC08A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: CA996FF9B01E1605591657F2D7FBE1DF
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: FD40AD9C6EA0E732D78000990DD58140
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 3702779E6700EECA99522AF259D36CA0
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
Frame ID: 064B5F42B9BB5EDB9BCEE6C48E082215
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43
Frame ID: 586E026B2BA41C9763C5F6607E07320C
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48
Frame ID: F3B8E41DD050A7ED5D4308F57D6FB90E
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53
Frame ID: 182A1A298D5BAB993A2FFBF767F88546
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Frame ID: 1A9B5715CCBC49BFD09D499475860801
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Frame ID: FD07813F46FCB546E7EE93C193E4C08D
Requests: 14 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: D42326696C6BEAF8FA478711ADED1011
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: BB3974E7B954CA8C4BFCD2FF246022E7
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 7AE912D732978C8B4EC685EDD3F8C51F
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 8DEBF0ABD49025053607CE32453D0D14
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 3681F450DB61FE224BD85FD5B60A6A03
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js
Frame ID: 7D575A12E5C0BDD7A184C83CB7956895
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js
Frame ID: 93F401B73C695A968EDDD1F3C9B59159
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 815BB588A71E96BF72AD0A7B9F4306FD
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A5A099DE6EA99831C25041174C1C8731
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 12D1E443ADA4226CF0EDA1238D8C64FA
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 00CA44E0F15F1DB81326445E3167408C
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 8C4439C7C2118ADA145A7BF509575E81
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 28A44272274A8C9FED423C571463AD50
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: DC6938DA8FBB521D7A192E531ED1B0B1
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B70DECABB97076422D8B0AE02735EF49
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js
Frame ID: B3C55DDEF3F4F18FCEAC0841BD13862C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cobalt Stike Beacon Detected - 179[.]60[.]146[.]51:443 - RedPacket Security

Page URL History Show full URLs

https://t.co/3tt2kxWiPY Page URL
https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

owl\.carousel.*\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

Page Statistics

283
Requests

89 %
HTTPS

52 %
IPv6

25
Domains

34
Subdomains

26
IPs

6
Countries

3043 kB
Transfer

7567 kB
Size

31
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/RedPacketSec

Search URL Search Domain Scan URL

URL: https://t.me/RedPacketSecurity

Search URL Search Domain Scan URL

URL: https://n8n.io/cloud?ref=redpacketsecurity&utm_source=affiliate&tap_s=1963097-b6ac83
Title: <img width="930" height="100" src="https://www.redpacketsecurity.com/wp-content/uploads/2022/08/n8n-banner.webp" class="attachment-full size-full" alt="" srcset="https://www.redpacketsecurity.com/wp-content/uploads/2022/08/n8n-banner.webp 930w, https://www.redpacketsecurity.com/wp-content/uploads/2022/08/n8n-banner-300x32.webp 300w, https://www.redpacketsecurity.com/wp-content/uploads/2022/08/n8n-banner-768x83.webp 768w" sizes="(max-width: 930px) 100vw, 930px" />

Search URL Search Domain Scan URL

URL: https://www.patreon.com/bePatron?u=37301876
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2021/01/Digital-Patreon-Wordmark_FieryCoralv2-1024x209.png" alt="Digital Patreon Wordmark FieryCoralv2" class="wp-image-10717" width="512" height="105" title="Cobalt Stike Beacon Detected - 179[.]60[.]146[.]51:443 2">

Search URL Search Domain Scan URL

URL: https://discord.gg/ED6T7awC
Title: <img width="402" height="125" src="https://www.redpacketsecurity.com/wp-content/uploads/2022/06/discord.png" alt="discord" class="wp-image-40367" srcset="https://www.redpacketsecurity.com/wp-content/uploads/2022/06/discord.png 402w, https://www.redpacketsecurity.com/wp-content/uploads/2022/06/discord-300x93.png 300w" sizes="(max-width: 402px) 100vw, 402px" title="Cobalt Stike Beacon Detected - 179[.]60[.]146[.]51:443 4">

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/RedPacketSecurity/
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2022/06/reddit-2000x690.png" alt="reddit" class="wp-image-40369" width="388" height="133" srcset="https://www.redpacketsecurity.com/wp-content/uploads/2022/06/reddit-2000x690.png 2000w, https://www.redpacketsecurity.com/wp-content/uploads/2022/06/reddit-300x103.png 300w, https://www.redpacketsecurity.com/wp-content/uploads/2022/06/reddit-768x265.png 768w, https://www.redpacketsecurity.com/wp-content/uploads/2022/06/reddit-1536x530.png 1536w, https://www.redpacketsecurity.com/wp-content/uploads/2022/06/reddit-2048x706.png 2048w, https://www.redpacketsecurity.com/wp-content/uploads/2022/06/reddit-1024x353.png 1024w" sizes="(max-width: 388px) 100vw, 388px" title="Cobalt Stike Beacon Detected - 179[.]60[.]146[.]51:443 5">

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/redpacket-security/
Title: <img src="https://www.redpacketsecurity.com/wp-content/uploads/2022/08/hd-linkedin.webp" alt="hd linkedin" class="wp-image-43441" width="390" height="224" title="Cobalt Stike Beacon Detected - 179[.]60[.]146[.]51:443 6">

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/&text=Cobalt%20Stike%20Beacon%20Detected%20%E2%80%93%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/&title=Cobalt%20Stike%20Beacon%20Detected%20%E2%80%93%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443

Search URL Search Domain Scan URL

URL: https://www.patreon.com/RedPacketSecurity?fan_landing=true
Title: <img width="300" height="300" src="https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE-300x300.jpg" class="image wp-image-15749 attachment-medium size-medium" alt="" style="max-width: 100%; height: auto;" srcset="https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE-300x300.jpg 300w, https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE-150x150.jpg 150w, https://www.redpacketsecurity.com/wp-content/uploads/2021/05/PATREON-SQUARE.jpg 500w" sizes="(max-width: 300px) 100vw, 300px" />

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/3tt2kxWiPY Page URL
https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

https://www.googleadservices.com/pagead/conversion/4209956877/?guid=ON&random=1662992943496&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ig=1&ref=https%3A%2F%2Ft.co%2F HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ig=1&ref=https%3A%2F%2Ft.co%2F&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=9kAfY63nK5CeywWUjICACg&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ig=1&ref=https%3A%2F%2Ft.co%2F&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9kAfY63nK5CeywWUjICACg&cid=CAQSKQCsnQUxcYerox23ZjHZsWTUOhTtKBXgaiK0d11tBlfzvKcw_RATKfuR&random=25300607 HTTP 302
https://www.google.it/pagead/1p-conversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ig=1&ref=https%3A%2F%2Ft.co%2F&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9kAfY63nK5CeywWUjICACg&cid=CAQSKQCsnQUxcYerox23ZjHZsWTUOhTtKBXgaiK0d11tBlfzvKcw_RATKfuR&random=25300607&ipr=y&prhg=0

Request Chain 59

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/4209956877/?guid=ON&random=1662992943496&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ig=1&ref=https%3A%2F%2Ft.co%2F HTTP 302
https://www.google.com/pagead/1p-user-list/4209956877/?guid=ON&random=1662992943496&fst=1662991200000&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ref=https%3A%2F%2Ft.co%2F&is_vtc=1&random=3096382455 HTTP 302
https://www.google.it/pagead/1p-user-list/4209956877/?guid=ON&random=1662992943496&fst=1662991200000&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ref=https%3A%2F%2Ft.co%2F&is_vtc=1&random=3096382455&ipr=y

Request Chain 131

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAehlK4D_LZbeGxH9gjVr8h0VL89qQbDCnGnP16C4Vx6S6kp2beTTzu9jQRTziaERA7-csJxXtQ8TtSoh143mFwu7I11hlpTEDsYn&google_gid=CAESEGn0i3TSfArXJz1ir1gpbuU&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFCYXIxZnl2dQ&google_push=AehlK4D_LZbeGxH9gjVr8h0VL89qQbDCnGnP16C4Vx6S6kp2beTTzu9jQRTziaERA7-csJxXtQ8TtSoh143mFwu7I11hlpTEDsYn

Request Chain 134

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4Bwu33ygNaNLZJOsXPQ5_YKIm3bL4GpsCRjcYDoL6vSwLELjBLMj-yIM1EsW99LkbEx7YH7IRs0UTmWKP62OYuvFCYiU20 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKN1UtMjMtNzVZOQ==&google_push=AehlK4Bwu33ygNaNLZJOsXPQ5_YKIm3bL4GpsCRjcYDoL6vSwLELjBLMj-yIM1EsW99LkbEx7YH7IRs0UTmWKP62OYuvFCYiU20

Request Chain 135

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&google_push=AehlK4AQ4ZQKjkWFOkQzXCV220AMERQI1lPeuMZ63MS0NxX1AzsquPVYR0YMv9etYwjVDmnKpvslsjW0fDWMw_3dDQYimPgoJ5in HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_push=AehlK4AQ4ZQKjkWFOkQzXCV220AMERQI1lPeuMZ63MS0NxX1AzsquPVYR0YMv9etYwjVDmnKpvslsjW0fDWMw_3dDQYimPgoJ5in&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4AQ4ZQKjkWFOkQzXCV220AMERQI1lPeuMZ63MS0NxX1AzsquPVYR0YMv9etYwjVDmnKpvslsjW0fDWMw_3dDQYimPgoJ5in

Request Chain 140

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 210

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4Bu9bk7qD2gTUP-3DDZpDbfpnRUoOiPQqToeYrHJwR_qmlgULjNwUMfl-NgFWDxihv2XbWw6FbVxoK0TUw62iCdX0fHESw&google_gid=CAESED6pcl_652T7hl0FC2xFLPs&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4Bu9bk7qD2gTUP-3DDZpDbfpnRUoOiPQqToeYrHJwR_qmlgULjNwUMfl-NgFWDxihv2XbWw6FbVxoK0TUw62iCdX0fHESw&google_gid=CAESED6pcl_652T7hl0FC2xFLPs&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4Bu9bk7qD2gTUP-3DDZpDbfpnRUoOiPQqToeYrHJwR_qmlgULjNwUMfl-NgFWDxihv2XbWw6FbVxoK0TUw62iCdX0fHESw

Request Chain 213

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4D0WtN7xYfeTJ4uYZhESJljsQY5iH9ZGKmzIxHZqxX_FzQnEZu9I_agRYdE5brQmlYnzqbOGEgFPKWxCuOaVhSjs6RPPmQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKSjctUC1DWUwz&google_push=AehlK4D0WtN7xYfeTJ4uYZhESJljsQY5iH9ZGKmzIxHZqxX_FzQnEZu9I_agRYdE5brQmlYnzqbOGEgFPKWxCuOaVhSjs6RPPmQ

Request Chain 214

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&google_push=AehlK4Crx5ZOBngIuLNH0uil7Z73DOfQz_VYHSviSYUHIjGEufQgiw-d8MnCjcFSICQ0yJxU_MSwCtEKBz52x3A5PGO9ye0JpTk HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Crx5ZOBngIuLNH0uil7Z73DOfQz_VYHSviSYUHIjGEufQgiw-d8MnCjcFSICQ0yJxU_MSwCtEKBz52x3A5PGO9ye0JpTk

Request Chain 217

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizhcw-W6vDgpGTfgFuyb4&google_cver=1&google_push=AehlK4A7EuY1OS5B7pA-kRMCK_qlqYsaOxQTGiYcfJmg1gTyhvKRZ9nISxQGNIaSzMG01c7OEhyIrUcNuQlQIAb7h9sn5TaF-q1e HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4A7EuY1OS5B7pA-kRMCK_qlqYsaOxQTGiYcfJmg1gTyhvKRZ9nISxQGNIaSzMG01c7OEhyIrUcNuQlQIAb7h9sn5TaF-q1e&google_hm=N6GZf_EUsj8L9_sGC7hNyw

Request Chain 218

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAehlK4DDsV5D1zxlUYSKm4IdoVlnOrlF6MeNaaWBSPxhmmME6qEdVlBZKt_VJDu7C8WWcm9eMy4A7lN0glHErn4o_vV53VcZI7Ni&google_gid=CAESEGn0i3TSfArXJz1ir1gpbuU&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFBRUtyeFVKUA&google_push=AehlK4DDsV5D1zxlUYSKm4IdoVlnOrlF6MeNaaWBSPxhmmME6qEdVlBZKt_VJDu7C8WWcm9eMy4A7lN0glHErn4o_vV53VcZI7Ni

Request Chain 222

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4CA7dmnU5i33dKmUrt0BLHf7e_zBktS2Dad1yd0OyzbdGkaSOJXgbd9f8HbAjBAjg0v6eF0B1SKQNT4luKIJSaXZS_Xtvuj HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKTFotSy1LMklH&google_push=AehlK4CA7dmnU5i33dKmUrt0BLHf7e_zBktS2Dad1yd0OyzbdGkaSOJXgbd9f8HbAjBAjg0v6eF0B1SKQNT4luKIJSaXZS_Xtvuj

Request Chain 223

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&google_push=AehlK4Bu7lB9m4onzqjfc586UDMFOfox3cyzwg2Sp6uTsgaxbXczj3ICI1jo_9XmMjgQL5v64_20YiT13AylTEgI-OrES8BEuqQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Bu7lB9m4onzqjfc586UDMFOfox3cyzwg2Sp6uTsgaxbXczj3ICI1jo_9XmMjgQL5v64_20YiT13AylTEgI-OrES8BEuqQ

Request Chain 225

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 229

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 253

https://d.agkn.com/pixel/2175/?google_gid=CAESEGuMZrlXnD2nOdDkRqRsPoo&google_cver=1&google_push=AehlK4Dt_X9_-uJhr9_N-ZPYuZNWnFfVSIwE2pTxmDvPRhRzdvQO_VIZriSwGVEvJWid4pGbginUVucYodNxbcYkhoHF16Y2Xow HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4Dt_X9_-uJhr9_N-ZPYuZNWnFfVSIwE2pTxmDvPRhRzdvQO_VIZriSwGVEvJWid4pGbginUVucYodNxbcYkhoHF16Y2Xow&google_hm=Q0FFU0VHdU1acmxYbkQybk9kRGtScVJzUG9v

Request Chain 254

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4C_JuLUtIBoVt6ezAsubAYA9Bw49GzrlNj1yxfYiMAyu7QsvHg_lk0m8I8wtB4YTuwlmuOLuTrnhfh-JQChXxNTdfnoig&google_gid=CAESED6pcl_652T7hl0FC2xFLPs&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4C_JuLUtIBoVt6ezAsubAYA9Bw49GzrlNj1yxfYiMAyu7QsvHg_lk0m8I8wtB4YTuwlmuOLuTrnhfh-JQChXxNTdfnoig

Request Chain 257

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4CYzfrGJvVR_jCQwOKXENYM_c_ZAW4dlslRi748G2xUBuf7p5J_njS7EqvgdjEHyLAmek549Vx5VpIWFu0EY6qi4DNZgg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLM0MtMTMtSUk2MQ==&google_push=AehlK4CYzfrGJvVR_jCQwOKXENYM_c_ZAW4dlslRi748G2xUBuf7p5J_njS7EqvgdjEHyLAmek549Vx5VpIWFu0EY6qi4DNZgg

Request Chain 258

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&google_push=AehlK4C-ANHvxK4DunlzoATzByEB5hLfMKZ7Gu4cx2Yyj-xp_1fzmoBHDKv0AicZJVTP5-VmmJ0p-BhROOnbgjz2BlXo6PFgrWo HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4C-ANHvxK4DunlzoATzByEB5hLfMKZ7Gu4cx2Yyj-xp_1fzmoBHDKv0AicZJVTP5-VmmJ0p-BhROOnbgjz2BlXo6PFgrWo

Request Chain 260

https://d.agkn.com/pixel/2175/?google_gid=CAESEGuMZrlXnD2nOdDkRqRsPoo&google_cver=1&google_push=AehlK4BU0bctb0rR-IzzZ93EEmw3Nj1g-nl7lBhTmDBbSluTx76stS1voU3QbEJ-VoMG4wQ7k2CQ99BYxZZlAr08BcjJjkf5Bw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4BU0bctb0rR-IzzZ93EEmw3Nj1g-nl7lBhTmDBbSluTx76stS1voU3QbEJ-VoMG4wQ7k2CQ99BYxZZlAr08BcjJjkf5Bw&google_hm=Q0FFU0VHdU1acmxYbkQybk9kRGtScVJzUG9v

Request Chain 261

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4DgqaqCtGwCdM108BuxaaPTf-gd1NIySpJKo2m-lzU9KVQGWicbPi3OmLQJ0HWhnKzkXIrdGpi1ogP2sHSneyyRbh4BSMk&google_gid=CAESED6pcl_652T7hl0FC2xFLPs&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4DgqaqCtGwCdM108BuxaaPTf-gd1NIySpJKo2m-lzU9KVQGWicbPi3OmLQJ0HWhnKzkXIrdGpi1ogP2sHSneyyRbh4BSMk

Request Chain 265

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&google_push=AehlK4BxzBy8SSjKISL77xD7zPBXnRYVuOG9lCOq5VwNQ8WU6a7dQZt-L2_ZvqDyJ-ru_Nixhp-o6NCaqVayIJuM-LQ5DF5XlTU HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BxzBy8SSjKISL77xD7zPBXnRYVuOG9lCOq5VwNQ8WU6a7dQZt-L2_ZvqDyJ-ru_Nixhp-o6NCaqVayIJuM-LQ5DF5XlTU

Request Chain 269

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4ADXoUXDkrB6gm3l6myxRpcRz0f6isnPxJevYLCuM3S8xGXWu7RWQHt52pfRAxPYH-6XKoMJMmDe2GxWv11SMeISDJsQA&google_gid=CAESED6pcl_652T7hl0FC2xFLPs&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ADXoUXDkrB6gm3l6myxRpcRz0f6isnPxJevYLCuM3S8xGXWu7RWQHt52pfRAxPYH-6XKoMJMmDe2GxWv11SMeISDJsQA

Request Chain 272

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4DX9k-hINxlIlm84HeebeFwkezZdECH--9rjaVFLXWxH_EoVi_Wix6EHOBVo3hWgbaHOzdG4VkLRYjtplknhDzoj1WuSEH2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNDMtNS1KSElP&google_push=AehlK4DX9k-hINxlIlm84HeebeFwkezZdECH--9rjaVFLXWxH_EoVi_Wix6EHOBVo3hWgbaHOzdG4VkLRYjtplknhDzoj1WuSEH2

Request Chain 273

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&google_push=AehlK4A-q-N3PFUtMpUFL20uUSc11JQIyZl0wBOuUEFwsDMPf60PNboIBdi1pKAwftrgzPs9uDXPkwBHtgWatt27hhY4sxkAVkk HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4A-q-N3PFUtMpUFL20uUSc11JQIyZl0wBOuUEFwsDMPf60PNboIBdi1pKAwftrgzPs9uDXPkwBHtgWatt27hhY4sxkAVkk

Request Chain 276

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 277

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizhcw-W6vDgpGTfgFuyb4&google_cver=1&google_push=AehlK4BZP6YDW0XTG_39Ev4RuSHUtz6SxSshnwtqO_TNoGBSSAD02SEHN5W-Yb54xoqBiQByn2lnOM6RDSLlfhNCq2GkWS5Abt4 HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4BZP6YDW0XTG_39Ev4RuSHUtz6SxSshnwtqO_TNoGBSSAD02SEHN5W-Yb54xoqBiQByn2lnOM6RDSLlfhNCq2GkWS5Abt4&google_hm=N6GZf_EUsj8L9_sGC7hNyw

Request Chain 278

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAehlK4BopHAMFRpzhBQ5wPjXpKO3hUCpgmefNK32aOB-2AAIw8Q-eUPSl0H8GJXo_PoiPJhcDyrCtalENiSAsdSAheH1XQA1ECBa&google_gid=CAESECJUZJlK72Cg-rg38DdInD8&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPmB_ZgGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BZWhsSzRCb3BIQU1GUnB6aEJRNXdQalhwS08zaFVDcGdtZWZOSzMyYU9CLTJBQUl3OFEtZVVQU2wwSDhHSlhvX1BvaVBKaGNEeXJDdGFsRU5pU0FzZFNBaGVIMVhRQTFFQ0Jh HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRlROVXZrd0xxRVVsSnBvNWNmQXZsQlR0MmRXTGtLMEpMdjVrSUNqdjZ3RQ==&google_push

Request Chain 279

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4ASV9D8p6yo7SsX2x_usdS6bzb1EQUaFxVSDI7V6BOP7qsG6yjtlAeWPH1Y-LOLCRNNWKBJH9NjJ0I8CSpd1dshMR2rI2x5&google_gid=CAESED6pcl_652T7hl0FC2xFLPs&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ASV9D8p6yo7SsX2x_usdS6bzb1EQUaFxVSDI7V6BOP7qsG6yjtlAeWPH1Y-LOLCRNNWKBJH9NjJ0I8CSpd1dshMR2rI2x5

Request Chain 282

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4DxZh4z5BJA8SwNK8tISa2XMVuUSvGHUG92T3y7T2HA2imLIuID3OdTg4U7ng1PgcDAoR5oUkItr5aNjRBo9VJ663srt7bi HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNFYtMjUtSElCRA==&google_push=AehlK4DxZh4z5BJA8SwNK8tISa2XMVuUSvGHUG92T3y7T2HA2imLIuID3OdTg4U7ng1PgcDAoR5oUkItr5aNjRBo9VJ663srt7bi

Request Chain 283

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&google_push=AehlK4BHcWcAk8NDqjvQDIc1hQzgukbvT1NtsOUfPAcVsOvV8leJ9VMfM44S-5HUgFUZZgFyd0_4hOzTqizkolBfkg5BO6RrVswa HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BHcWcAk8NDqjvQDIc1hQzgukbvT1NtsOUfPAcVsOvV8leJ9VMfM44S-5HUgFUZZgFyd0_4hOzTqizkolBfkg5BO6RrVswa

Request Chain 285

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 286

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 287

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

283 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 3tt2kxWiPY
t.co/ 414 B
560 B 286ms
179ms Document
text/html 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/3tt2kxWiPY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 228
content-type: text/html; charset=utf-8
date: Mon, 12 Sep 2022 14:23:49 GMT
expires: Mon, 12 Sep 2022 14:28:49 GMT
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 4a8418f949806ce2bda9a508ef580164af7a36537473514966655361db16cdd4
x-response-time: 120
x-xss-protection: 0

GET
H2 200 Primary Request / Show response
www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/ 151 KB
31 KB 487ms
414ms Document
text/html 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Requested by

Host: t.co
URL: https://t.co/3tt2kxWiPY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.4.30 PleskLin

Resource Hash

72f9eff3310a83b226f6209be6064a9aa6f3724dd5eb0c69e6390713f104f6a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=43200
cf-apo-via: origin,miss
cf-cache-status: MISS
cf-ray: 74994d9e0e6bbaff-MXP
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:23:49 GMT
last-modified: Sun, 11 Sep 2022 02:16:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7g3iuY3P3mD65N38Aj7v2%2FpW5M6dMGDARSKLz6rpA28fhmCfdQpdkiZM9T0zs0gTOD4TD57oyB7YiSdf753OqxVn0j%2FoI7sQdDw9TQsBZpdfiw%2FQ%2FYM%2BbCzOCIxdNgbMtJSMGnfvLypgpmUcrKizCb0f%2B0j%2F3xw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15768000; includeSubDomains
vary: Accept-Encoding
wpo-cache-status: cached
x-powered-by: PHP/7.4.30 PleskLin

GET
H2 200 style.min.css
www.redpacketsecurity.com/wp-includes/css/dist/block-library/ 87 KB
12 KB 55ms
53ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/css/dist/block-library/style.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3144
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 12 Jul 2022 20:48:30 GMT
server: cloudflare
etag: W/"62cdde1e-15b64"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FtFEXsa7NE8gJoGOlckzYounk8Hq5N7BtGqnvwgmdHwY1GOIsxHR9KABINback%2FPv3fsbKdW84NPqxedvQzWa6fTyIGyOZkfoD9SMhWWFHdR3gHRyZGKHv7fL4RODWOh3NHwxoH2sqtXkBjCiI2JdIac7at5wFY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 74994da09c70baff-MXP

GET
H2 200 app.css
www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/css/ 2 KB
987 B 67ms
66ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/css/app.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

af12f7592b4d8f6b8483bd9bab081ecf35abe485d5315fb0ecf30559ac2bd9cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3145
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 05 Jul 2022 20:38:48 GMT
server: cloudflare
etag: W/"62c4a158-bd4"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iodFrrw9i9vSfbsrjjDwrFG8eJ8gc1rfdXaF8pS07Zh%2BXaAjij93iwoN6PmdllnZVMhmoh5aXueUOTrsrHA9eJiHTlS7VGZRZOXu0%2FWfKlMtX9c4P1iHARNCJs7a0w%2B%2Fx%2BFqQTpK1t47f5kQ%2FwttDQO1TuzaGeo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-polished: origSize=3028
cf-ray: 74994da09c75baff-MXP
cf-bgj: minify

GET
H2 200 style.min.css
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/ 2 KB
903 B 40ms
40ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/style.min.css?ver=5.2.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

578ece1ba13e8a1dd211785e2df101ac5f9d1f2e387f9c6557bf51637ad0b84b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3145
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 13 Jun 2022 19:27:37 GMT
server: cloudflare
etag: W/"62a78fa9-6bd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rQkPDDSCriOL5cXYpUGpuTB4moCPYjRJzqtDuH6pyj1GTgU9L1Joc7lDSuDIH30sl%2BdJNmyTucK4rhFJIWAeicCfbHm7QjkjgqcHcmtVeuI5zSTIk867qaYDx3b8%2FquykE9r2mR99LwJkyOXZyAESUsSK0l6rHo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 74994da09c78baff-MXP

GET
H2 200 style.min.css
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/list/ 9 KB
2 KB 45ms
44ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/list/style.min.css?ver=1.2.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

13ea1503dc13c1d5259d6d10430aadc0fe269a78016fa6b7e0a41d653c6a7001

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3145
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 13 Jun 2022 19:27:37 GMT
server: cloudflare
etag: W/"62a78fa9-233b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDV71dLD0Sg9fHzTxOyJ7WepEQ52fQa8SLyZJWDMbMY6XWVycG16Tv5qezID4CzpL9UkMMhcf3yZPlrzVRzwVF9P0Gxgz8daaa6HwExBQ%2F8IXB%2Bk3L1oAqQMA%2FMe5RC2GgO2pq538wq2BYK3kyde%2BH5MWKw48cA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 74994da09c7ebaff-MXP

GET
H2 200 style.min.css
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/text/ 16 B
353 B 53ms
52ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/text/style.min.css?ver=1.0.1

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

9ddc0f6530a2a949a60ecc192689aba25551e0f9f6270b44803134b27708d883

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3145
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16
last-modified: Mon, 13 Jun 2022 19:27:37 GMT
server: cloudflare
etag: "10-5e15947dadc3a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zjF0JP85wjsmdtjcJqu%2FTDaOCjuq3Xr4D4YwjyMJtyrLq0sprDD6E%2F1rGDtQnqHG9lQ%2BEym6euvxwQxcP8EHJzlFQqgjeIpxgmMKZ8zdEEhlk7t32QUe0Po8eoUUChAjbCvWRFKAEWitH33DPjAC%2BtqytWPIvWE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-accel-version: 0.01
cache-control: max-age=43200
accept-ranges: bytes
cf-ray: 74994da09c80baff-MXP

GET
H2 200 css
fonts.googleapis.com/ 6 KB
1 KB 150ms
47ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat%3A400%2C500%2C700%2C800%7CWork%2BSans%3A300%2C400%2C500%2C600%2C700%2C800%2C900%26display%3Dswap&subset=latin%2Clatin-ext

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d951736694abf6e078c76c38dc0c83979714734d020a73d59d066f652c75e3b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 14:04:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:50 GMT

GET
H2 200 css
fonts.googleapis.com/ 594 KB
44 KB 90ms
49ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=ABeeZee%7CAbel%7CAbril+Fatface%7CAclonica%7CAcme%7CActor%7CAdamina%7CAdvent+Pro%7CAguafina+Script%7CAkronim%7CAladin%7CAldrich%7CAlef%7CAlegreya%7CAlegreya+SC%7CAlegreya+Sans%7CAlegreya+Sans+SC%7CAlex+Brush%7CAlfa+Slab+One%7CAlice%7CAlike%7CAlike+Angular%7CAllan%7CAllerta%7CAllerta+Stencil%7CAllura%7CAlmendra%7CAlmendra+Display%7CAlmendra+SC%7CAmarante%7CAmaranth%7CAmatic+SC%7CAmatica+SC%7CAmethysta%7CAmiko%7CAmiri%7CAmita%7CAnaheim%7CAndada%7CAndika%7CAngkor%7CAnnie+Use+Your+Telescope%7CAnonymous+Pro%7CAntic%7CAntic+Didone%7CAntic+Slab%7CAnton%7CArapey%7CArbutus%7CArbutus+Slab%7CArchitects+Daughter%7CArchivo+Black%7CArchivo+Narrow%7CAref+Ruqaa%7CArima+Madurai%7CArimo%7CArizonia%7CArmata%7CArtifika%7CArvo%7CArya%7CAsap%7CAsar%7CAsset%7CAssistant%7CAstloch%7CAsul%7CAthiti%7CAtma%7CAtomic+Age%7CAubrey%7CAudiowide%7CAutour+One%7CAverage%7CAverage+Sans%7CAveria+Gruesa+Libre%7CAveria+Libre%7CAveria+Sans+Libre%7CAveria+Serif+Libre%7CBad+Script%7CBaloo%7CBaloo+Bhai%7CBaloo+Da%7CBaloo+Thambi%7CBalthazar%7CBangers%7CBasic%7CBattambang%7CBaumans%7CBayon%7CBelgrano%7CBelleza%7CBenchNine%7CBentham%7CBerkshire+Swash%7CBevan%7CBigelow+Rules%7CBigshot+One%7CBilbo%7CBilbo+Swash+Caps%7CBioRhyme%7CBioRhyme+Expanded%7CBiryani%7CBitter%7CBlack+Ops+One%7CBokor%7CBonbon%7CBoogaloo%7CBowlby+One%7CBowlby+One+SC%7CBrawler%7CBree+Serif%7CBubblegum+Sans%7CBubbler+One%7CBuda%7CBuenard%7CBungee%7CBungee+Hairline%7CBungee+Inline%7CBungee+Outline%7CBungee+Shade%7CButcherman%7CButterfly+Kids%7CCabin%7CCabin+Condensed%7CCabin+Sketch%7CCaesar+Dressing%7CCagliostro%7CCairo%7CCalligraffitti%7CCambay%7CCambo%7CCandal%7CCantarell%7CCantata+One%7CCantora+One%7CCapriola%7CCardo%7CCarme%7CCarrois+Gothic%7CCarrois+Gothic+SC%7CCarter+One%7CCatamaran%7CCaudex%7CCaveat%7CCaveat+Brush%7CCedarville+Cursive%7CCeviche+One%7CChanga%7CChanga+One%7CChango%7CChathura%7CChau+Philomene+One%7CChela+One%7CChelsea+Market%7CChenla%7CCherry+Cream+Soda%7CCherry+Swash%7CChewy%7CChicle%7CChivo%7CChonburi%7CCinzel%7CCinzel+Decorative%7CClicker+Script%7CCoda%7CCoda+Caption%7CCodystar%7CCoiny%7CCombo%7CComfortaa%7CComing+Soon%7CConcert+One%7CCondiment%7CContent%7CContrail+One%7CConvergence%7CCookie%7CCopse%7CCorben%7CCormorant%7CCormorant+Garamond%7CCormorant+Infant%7CCormorant+SC%7CCormorant+Unicase%7CCormorant+Upright%7CCourgette%7CCousine%7CCoustard%7CCovered+By+Your+Grace%7CCrafty+Girls%7CCreepster%7CCrete+Round%7CCrimson+Text%7CCroissant+One%7CCrushed%7CCuprum%7CCutive%7CCutive+Mono%7CDamion%7CDancing+Script%7CDangrek%7CDavid+Libre%7CDawning+of+a+New+Day%7CDays+One%7CDekko%7CDelius%7CDelius+Swash+Caps%7CDelius+Unicase%7CDella+Respira%7CDenk+One%7CDevonshire%7CDhurjati%7CDidact+Gothic%7CDiplomata%7CDiplomata+SC%7CDomine%7CDonegal+One%7CDoppio+One%7CDorsa%7CDosis%7CDr+Sugiyama%7CDroid+Sans%7CDroid+Sans+Mono%7CDroid+Serif%7CDuru+Sans%7CDynalight%7CEB+Garamond%7CEagle+Lake%7CEater%7CEconomica%7CEczar%7CEk+Mukta%7CEl+Messiri%7CElectrolize%7CElsie%7CElsie+Swash+Caps%7CEmblema+One%7CEmilys+Candy%7CEngagement%7CEnglebert%7CEnriqueta%7CErica+One%7CEsteban%7CEuphoria+Script%7CEwert%7CExo%7CExo+2%7CExpletus+Sans%7CFanwood+Text%7CFarsan%7CFascinate%7CFascinate+Inline%7CFaster+One%7CFasthand%7CFauna+One%7CFederant%7CFedero%7CFelipa%7CFenix%7CFinger+Paint%7CFira+Mono%7CFira+Sans%7CFjalla+One%7CFjord+One%7CFlamenco%7CFlavors%7CFondamento%7CFontdiner+Swanky%7CForum%7CFrancois+One%7CFrank+Ruhl+Libre%7CFreckle+Face%7CFredericka+the+Great%7CFredoka+One%7CFreehand%7CFresca%7CFrijole%7CFruktur%7CFugaz+One%7CGFS+Didot%7CGFS+Neohellenic%7CGabriela%7CGafata%7CGalada%7CGaldeano%7CGalindo%7CGentium+Basic%7CGentium+Book+Basic%7CGeo%7CGeostar%7CGeostar+Fill%7CGermania+One%7CGidugu%7CGilda+Display%7CGive+You+Glory%7CGlass+Antiqua%7CGlegoo%7CGloria+Hallelujah%7CGoblin+One%7CGochi+Hand%7CGorditas%7CGoudy+Bookletter+1911%7CGraduate%7CGrand+Hotel%7CGravitas+One%7CGreat+Vibes%7CGriffy%7CGruppo%7CGudea%7CGurajada%7CHabibi%7CHalant%7CHammersmith+One%7CHanalei%7CHanalei+Fill%7CHandlee%7CHanuman%7CHappy+Monkey%7CHarmattan%7CHeadland+One%7CHeebo%7CHenny+Penny%7CHerr+Von+Muellerhoff%7CHind%7CHind+Guntur%7CHind+Madurai%7CHind+Siliguri%7CHind+Vadodara%7CHoltwood+One+SC%7CHomemade+Apple%7CHomenaje%7CIM+Fell+DW+Pica%7CIM+Fell+DW+Pica+SC%7CIM+Fell+Double+Pica%7CIM+Fell+Double+Pica+SC%7CIM+Fell+English%7CIM+Fell+English+SC%7CIM+Fell+French+Canon%7CIM+Fell+French+Canon+SC%7CIM+Fell+Great+Primer%7CIM+Fell+Great+Primer+SC%7CIceberg%7CIceland%7CImprima%7CInconsolata%7CInder%7CIndie+Flower%7CInika%7CInknut+Antiqua%7CIrish+Grover%7CIstok+Web%7CItaliana%7CItalianno%7CItim%7CJacques+Francois%7CJacques+Francois+Shadow%7CJaldi%7CJim+Nightshade%7CJockey+One%7CJolly+Lodger%7CJomhuria%7CJosefin+Sans%7CJosefin+Slab%7CJoti+One%7CJudson%7CJulee%7CJulius+Sans+One%7CJunge%7CJura%7CJust+Another+Hand%7CJust+Me+Again+Down+Here%7CKadwa%7CKalam%7CKameron%7CKanit%7CKantumruy%7CKarla%7CKarma%7CKatibeh%7CKaushan+Script%7CKavivanar%7CKavoon%7CKdam+Thmor%7CKeania+One%7CKelly+Slab%7CKenia%7CKhand%7CKhmer%7CKhula%7CKite+One%7CKnewave%7CKotta+One%7CKoulen%7CKranky%7CKreon%7CKristi%7CKrona+One%7CKumar+One%7CKumar+One+Outline%7CKurale%7CLa+Belle+Aurore%7CLaila%7CLakki+Reddy%7CLalezar%7CLancelot%7CLateef%7CLato%7CLeague+Script%7CLeckerli+One%7CLedger%7CLekton%7CLemon%7CLemonada%7CLibre+Baskerville%7CLibre+Franklin%7CLife+Savers%7CLilita+One%7CLily+Script+One%7CLimelight%7CLinden+Hill%7CLobster%7CLobster+Two%7CLondrina+Outline%7CLondrina+Shadow%7CLondrina+Sketch%7CLondrina+Solid%7CLora%7CLove+Ya+Like+A+Sister%7CLoved+by+the+King%7CLovers+Quarrel%7CLuckiest+Guy%7CLusitana%7CLustria%7CMacondo%7CMacondo+Swash+Caps%7CMada%7CMagra%7CMaiden+Orange%7CMaitree%7CMako%7CMallanna%7CMandali%7CMarcellus%7CMarcellus+SC%7CMarck+Script%7CMargarine%7CMarko+One%7CMarmelad%7CMartel%7CMartel+Sans%7CMarvel%7CMate%7CMate+SC%7CMaven+Pro%7CMcLaren%7CMeddon%7CMedievalSharp%7CMedula+One%7CMeera+Inimai%7CMegrim%7CMeie+Script%7CMerienda%7CMerienda+One%7CMerriweather%7CMerriweather+Sans%7CMetal%7CMetal+Mania%7CMetamorphous%7CMetrophobic%7CMichroma%7CMilonga%7CMiltonian%7CMiltonian+Tattoo%7CMiniver%7CMiriam+Libre%7CMirza%7CMiss+Fajardose%7CMitr%7CModak%7CModern+Antiqua%7CMogra%7CMolengo%7CMolle%7CMonda%7CMonofett%7CMonoton%7CMonsieur+La+Doulaise%7CMontaga%7CMontez%7CMontserrat%7CMontserrat+Alternates%7CMontserrat+Subrayada%7CMoul%7CMoulpali%7CMountains+of+Christmas%7CMouse+Memoirs%7CMr+Bedfort%7CMr+Dafoe%7CMr+De+Haviland%7CMrs+Saint+Delafield%7CMrs+Sheppards%7CMukta+Vaani%7CMuli%7CMystery+Quest%7CNTR%7CNeucha%7CNeuton%7CNew+Rocker%7CNews+Cycle%7CNiconne%7CNixie+One%7CNobile%7CNokora%7CNorican%7CNosifer%7CNothing+You+Could+Do%7CNoticia+Text%7CNoto+Sans%7CNoto+Serif%7CNova+Cut%7CNova+Flat%7CNova+Mono%7CNova+Oval%7CNova+Round%7CNova+Script%7CNova+Slim%7CNova+Square%7CNumans%7CNunito%7COdor+Mean+Chey%7COffside%7COld+Standard+TT%7COldenburg%7COleo+Script%7COleo+Script+Swash+Caps%7COpen+Sans%7COpen+Sans+Condensed%7COranienbaum%7COrbitron%7COregano%7COrienta%7COriginal+Surfer%7COswald%7COver+the+Rainbow%7COverlock%7COverlock+SC%7COvo%7COxygen%7COxygen+Mono%7CPT+Mono%7CPT+Sans%7CPT+Sans+Caption%7CPT+Sans+Narrow%7CPT+Serif%7CPT+Serif+Caption%7CPacifico%7CPalanquin%7CPalanquin+Dark%7CPaprika%7CParisienne%7CPassero+One%7CPassion+One%7CPathway+Gothic+One%7CPatrick+Hand%7CPatrick+Hand+SC%7CPattaya%7CPatua+One%7CPavanam%7CPaytone+One%7CPeddana%7CPeralta%7CPermanent+Marker%7CPetit+Formal+Script%7CPetrona%7CPhilosopher%7CPiedra%7CPinyon+Script%7CPirata+One%7CPlaster%7CPlay%7CPlayball%7CPlayfair+Display%7CPlayfair+Display+SC%7CPodkova%7CPoiret+One%7CPoller+One%7CPoly%7CPompiere%7CPontano+Sans%7CPoppins%7CPort+Lligat+Sans%7CPort+Lligat+Slab%7CPragati+Narrow%7CPrata%7CPreahvihear%7CPress+Start+2P%7CPridi%7CPrincess+Sofia%7CProciono%7CPrompt%7CProsto+One%7CProza+Libre%7CPuritan%7CPurple+Purse%7CQuando%7CQuantico%7CQuattrocento%7CQuattrocento+Sans%7CQuestrial%7CQuicksand%7CQuintessential%7CQwigley%7CRacing+Sans+One%7CRadley%7CRajdhani%7CRakkas%7CRaleway%7CRaleway+Dots%7CRamabhadra%7CRamaraja%7CRambla%7CRammetto+One%7CRanchers%7CRancho%7CRanga%7CRasa%7CRationale%7CRavi+Prakash%7CRedressed%7CReem+Kufi%7CReenie+Beanie%7CRevalia%7CRhodium+Libre%7CRibeye%7CRibeye+Marrow%7CRighteous%7CRisque%7CRoboto%7CRoboto+Condensed%7CRoboto+Mono%7CRoboto+Slab%7CRochester%7CRock+Salt%7CRokkitt%7CRomanesco%7CRopa+Sans%7CRosario%7CRosarivo%7CRouge+Script%7CRozha+One%7CRubik%7CRubik+Mono+One%7CRubik+One%7CRuda%7CRufina%7CRuge+Boogie%7CRuluko%7CRum+Raisin%7CRuslan+Display%7CRusso+One%7CRuthie%7CRye%7CSacramento%7CSahitya%7CSail%7CSalsa%7CSanchez%7CSancreek%7CSansita+One%7CSarala%7CSarina%7CSarpanch%7CSatisfy%7CScada%7CScheherazade%7CSchoolbell%7CScope+One%7CSeaweed+Script%7CSecular+One%7CSevillana%7CSeymour+One%7CShadows+Into+Light%7CShadows+Into+Light+Two%7CShanti%7CShare%7CShare+Tech%7CShare+Tech+Mono%7CShojumaru%7CShort+Stack%7CShrikhand%7CSiemreap%7CSigmar+One%7CSignika%7CSignika+Negative%7CSimonetta%7CSintony%7CSirin+Stencil%7CSix+Caps%7CSkranji%7CSlabo+13px%7CSlabo+27px%7CSlackey%7CSmokum%7CSmythe%7CSniglet%7CSnippet%7CSnowburst+One%7CSofadi+One%7CSofia%7CSonsie+One%7CSorts+Mill+Goudy%7CSource+Code+Pro%7CSource+Sans+Pro%7CSource+Serif+Pro%7CSpace+Mono%7CSpecial+Elite%7CSpicy+Rice%7CSpinnaker%7CSpirax%7CSquada+One%7CSree+Krushnadevaraya%7CSriracha%7CStalemate%7CStalinist+One%7CStardos+Stencil%7CStint+Ultra+Condensed%7CStint+Ultra+Expanded%7CStoke%7CStrait%7CSue+Ellen+Francisco%7CSuez+One%7CSumana%7CSunshiney%7CSupermercado+One%7CSura%7CSuranna%7CSuravaram%7CSuwannaphum%7CSwanky+and+Moo+Moo%7CSyncopate%7CTangerine%7CTaprom%7CTauri%7CTaviraj%7CTeko%7CTelex%7CTenali+Ramakrishna%7CTenor+Sans%7CText+Me+One%7CThe+Girl+Next+Door%7CTienne%7CTillana%7CTimmana%7CTinos%7CTitan+One%7CTitillium+Web%7CTrade+Winds%7CTrirong%7CTrocchi%7CTrochut%7CTrykker%7CTulpen+One%7CUbuntu%7CUbuntu+Condensed%7CUbuntu+Mono%7CUltra%7CUncial+Antiqua%7CUnderdog%7CUnica+One%7CUnifrakturCook%7CUnifrakturMaguntia%7CUnkempt%7CUnlock%7CUnna%7CVT323%7CVampiro+One%7CVarela%7CVarela+Round%7CVast+Shadow%7CVesper+Libre%7CVibur%7CVidaloka%7CViga%7CVoces%7CVolkhov%7CVollkorn%7CVoltaire%7CWaiting+for+the+Sunrise%7CWallpoet%7CWalter+Turncoat%7CWarnes%7CWellfleet%7CWendy+One%7CWire+One%7CWork+Sans%7CYanone+Kaffeesatz%7CYantramanav%7CYatra+One%7CYellowtail%7CYeseva+One%7CYesteryear%7CYrsa%7CZeyada&subset=latin%2Clatin-ext

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

38bc64c56d310172249705bc1cdd02ab368c26550ebe05c708c0703049edc79b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 14:14:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:50 GMT

GET
H3 200 bootstrap.css
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/ 156 KB
26 KB 76ms
74ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/bootstrap.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

e9d9a4ac74e536c050e8c6c9a95941e5009411ae61e9c2bcd8371f638b2ec661

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-329f6"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ANdpIgX6WBUjW1bH8rYYqmWYtSHe%2B42FNQg8wtVGekzS9qU38fw%2FOVs6dRGTkJId3Zb5leYz%2FYNNa%2BKklps85nOx18kAODgHxb48PM%2FI9x22dAz0DVmxd0f08pw%2BUTNrEVO8JswGmO%2FkEsZziSlCmvfl5ODNixs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-polished: origSize=207350
cf-ray: 74994da139d23747-MXP
cf-bgj: minify

GET
H3 200 style.css
www.redpacketsecurity.com/wp-content/themes/newsup-pro/ 62 KB
13 KB 47ms
45ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/style.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

f84781d3e65130fbcee9c8813916246764b2e335a6a4827009f817c3ca74c3f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-152e7"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eBW9xPEgKp3hZzUdxvjok6Kt4ev1rOl7WYhaKAXhCSfwdQrNI%2BkVHpimHYH4GKN%2BBlZYRtZuEfyX2kkKFMWT7xfWN5R8CDIxFVprPdTHcP%2F2xYxTSlt%2BqvWAGJv7tvXLOf%2BTsQZfXiqraa2F5uvy3ciWXhAq4cA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-polished: origSize=86759
cf-ray: 74994da139d73747-MXP
cf-bgj: minify

GET
H3 200 light.css
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/colors/ 92 B
663 B 77ms
76ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/colors/light.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

af468a53ff8b21e58d333969b462d31f6d23e94d0f255e58b8c9242057d29c34

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"81-5e17b59d731a3-gzip"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hVT91N%2BSgAbZiwleonM%2FkESAKv0YCKnO3wSYObzfQiiUxXZa1yUyjlKrrwDc8PuX0otCWH%2FN8kGm291SJxBv2SuYyWwlcuG80QZ4ZSbkJPq6NFp8Ed%2BBTD%2Bfwd3IV7NaLKmH1vmlWO20vGvp3vwYBbM91fXl0y0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-accel-version: 0.01
cache-control: max-age=43200
cf-polished: origSize=129
cf-ray: 74994da139d93747-MXP
cf-bgj: minify

GET
H3 200 all.min.css
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/ 55 KB
13 KB 78ms
76ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/all.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

04aec4107954c62d888f138cac63e9fd4508ca8bfcdaf9a9e3ade5eed2333b79

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-dcc9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y7A9da6YGXBLhZeDDW539htSh1b1MS8mBNq%2Bjl2e5eALU%2B6WsKfvceD9%2FNTFMI2GNe%2Bf%2BsqA5TIKWqRNqeCO3TEscaaak2KL5erSAA%2FjWlBu48Fi5ClW3z513k%2BooYWvaSXAqnyjtnmEALhj%2FsHgVfPNEoiDYMM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 74994da139db3747-MXP

GET
H3 200 v4-shims.min.css
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/ 26 KB
5 KB 102ms
101ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/v4-shims.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

b2be9c7c3f5b1cfa7055b5f64d499416c9b680b0b6030677c323164358f49a99

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-6806"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PGBAkpH6uwz2oDF2L8CtFoqr3bfKGl2qvKMJDqcKboo%2FNiugVYDqq3mue3fHlWbaOGYC67o20nQePOgzBttz896cSl8130pIVoR7UFMxtetv%2BSGnRfNakl5cDIQzajhXUb%2FN7%2FhAgMvBrs%2FxLYRFRObpbqe1r3U%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 74994da139dd3747-MXP

GET
H3 200 owl.carousel.css
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/ 1 KB
938 B 103ms
101ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/owl.carousel.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

eee2832920de823a77ade71ddf71f135ef58d3d7aa14c2e48036e1faec3c2762

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-60b"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J2CHcPTysB9%2FAHxNLm9f0XsLIiWZ8E3kI292ShqV%2F3667myGPAtzTGgc6SJ8DXNwyHGwc7iZAxw7MnX0pEZKY5Y7wpYTFkJ8MH0dtjuYMIDnKJ6CLevS3xkDCMIkzoI%2FLY6DX%2FUTrE%2ByOYQNwWfC66FGb5TLHVM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-polished: origSize=1547
cf-ray: 74994da139de3747-MXP
cf-bgj: minify

GET
H3 200 jquery.smartmenus.bootstrap.css
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/ 3 KB
1 KB 103ms
102ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/jquery.smartmenus.bootstrap.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

9b67a14d3266023e71ecdf6bbb6376034a486e07e1da880f536af90fb1c07711

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-fdb"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j9qhy%2FLHZEab2vo63wdXg5r0ALRl1ICB40OiLIKnwMEzgW85ciFd8QFjO0gUzB%2Fr7LfksfO5tlnsA5LsBy6sD4TSwSaOj5qSifgunWjx4InX8cr9GNuL8QSFYk7OJJl3XqHfl0kzGa2try6s6M7jODi69UMxApw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-polished: origSize=4059
cf-ray: 74994da139e13747-MXP
cf-bgj: minify

GET
H3 200 dashicons.min.css
www.redpacketsecurity.com/wp-includes/css/ 58 KB
35 KB 103ms
102ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/css/dashicons.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 15 Apr 2021 03:42:13 GMT
server: cloudflare
etag: W/"6077b615-e688"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iyedcPir4nFDX7KwXPsFRnBNu3wRAhR%2BdvbXz31bzEalzXqdN3WNn7Pv%2FXlmF59p9nH%2FEkuVGxv8no%2FQSll5vBzSXvy2pnvUJtrdeREyQoce83HeFjMGY5%2FX0lvJQgME8WNSIQUib5xLoKAEFMgr6eKh%2FqfmuD8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 74994da139e23747-MXP

GET
H3 200 wp-pointer.min.css
www.redpacketsecurity.com/wp-includes/css/ 3 KB
1 KB 125ms
124ms Stylesheet
text/css 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/css/wp-pointer.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

ace0366eab1ff253f3ccc456913f0cd991bd1ead16846297ba62c40e2f0dcd5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 25 Jan 2022 21:10:27 GMT
server: cloudflare
etag: W/"61f06743-ca6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TKwK%2F%2FJI7oAMjYqeyaDmEQ1YEvm6T0t1iIqns9qaN5KVFeQ3Z3%2BNTvmA9TgZr1hhFTW%2Fgs%2BbrfwcduQ%2BJJfjewrs0Mh35zJ4jKmH4lMNeAKq42wMP9tyoAak6wfnxhyZw%2Bj8PhYHTFfyMgQ9BkwpeRqOkDrbUbs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 74994da139e53747-MXP

GET
H3 200 email-decode.min.js Show response
www.redpacketsecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 32ms
31ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Sep 2022 17:30:56 GMT
server: cloudflare
etag: W/"631783d0-4d7"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UBcGkSVPes%2BlGqdjPmvuEz0SjPt%2BJqYBLw3fwc3wyIOTiOZgzg8JY0iVnuKmm1o38rjDb2rZ7fN1DSd3PTTT6DurdnrBMnzsDeUnURP114oZYLjOD%2BA4l5IsnbKuGS2V5aXe7CTALj%2BPX5Vrvqqczu60Q3addYU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 74994da139e63747-MXP
vary: Accept-Encoding
expires: Wed, 14 Sep 2022 14:23:49 GMT

GET
H3 200 rocket-loader.min.js Show response
www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 29ms
29ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Sep 2022 17:30:56 GMT
server: cloudflare
etag: W/"631783d0-302c"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q73%2Bwe4BG4RmdxtkxTy1XjUCaM5J1c6zqSPI6I1V9KIMZEVcuN03bwLm2CsZjo1sdfkbdvv3GUtBewX%2B%2FoIXu48STCQTiR3ORl7UrzPKB1%2BVsHtLkhoK4p97WUnnMmhZnpqbY5y4h1vQ2wp4DQBu9xDKRlMlh7E%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 74994da20b5d3747-MXP
vary: Accept-Encoding
expires: Wed, 14 Sep 2022 14:23:50 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 122ms
68ms Script
text/javascript 2606:4700:440e::6812:2fe6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://www.redpacketsecurity.com/
Origin: https://www.redpacketsecurity.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 74994da288093760-MXP

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 cropped-hd-wallpaper-gf892c9c95_1920.jpg
www.redpacketsecurity.com/wp-content/uploads/2022/08/ 282 KB
283 KB 52ms
52ms Image
image/jpeg 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2022/08/cropped-hd-wallpaper-gf892c9c95_1920.jpg

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

42f0cb1bc94d52bd78d92d74a31f2b7abe168da76fc3dbd4840fa540b5a32ae6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 288652
last-modified: Wed, 10 Aug 2022 21:40:13 GMT
server: cloudflare
etag: "62f425bd-469f9"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J78ofPTn2SPHq%2FvLCpatyinlvmOZ9aeXlY4UfH%2Fzge3d6sdmJRRUwI8t3AHHR1Jpjl6S%2FEBKkRUGjaUASUzslycY0CiYMCWUXyWssiXN8xcouVH4PEZu4wc7xuNDRgSLQeE6pUQT%2BBJN5xIUIX0yVQRNjUpH4nQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=43200
cf-polished: origSize=289273, status=webp_bigger
accept-ranges: bytes
cf-ray: 74994da3ef4b3747-MXP
cf-bgj: imgq:100,h2pri

GET
H2 200 QGY_z_wNahGAdqQ43RhVcIgYT2Xz5u32K0nXBi8Jpg.woff2
fonts.gstatic.com/s/worksans/v18/ 17 KB
18 KB 206ms
120ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/worksans/v18/QGY_z_wNahGAdqQ43RhVcIgYT2Xz5u32K0nXBi8Jpg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=ABeeZee%7CAbel%7CAbril+Fatface%7CAclonica%7CAcme%7CActor%7CAdamina%7CAdvent+Pro%7CAguafina+Script%7CAkronim%7CAladin%7CAldrich%7CAlef%7CAlegreya%7CAlegreya+SC%7CAlegreya+Sans%7CAlegreya+Sans+SC%7CAlex+Brush%7CAlfa+Slab+One%7CAlice%7CAlike%7CAlike+Angular%7CAllan%7CAllerta%7CAllerta+Stencil%7CAllura%7CAlmendra%7CAlmendra+Display%7CAlmendra+SC%7CAmarante%7CAmaranth%7CAmatic+SC%7CAmatica+SC%7CAmethysta%7CAmiko%7CAmiri%7CAmita%7CAnaheim%7CAndada%7CAndika%7CAngkor%7CAnnie+Use+Your+Telescope%7CAnonymous+Pro%7CAntic%7CAntic+Didone%7CAntic+Slab%7CAnton%7CArapey%7CArbutus%7CArbutus+Slab%7CArchitects+Daughter%7CArchivo+Black%7CArchivo+Narrow%7CAref+Ruqaa%7CArima+Madurai%7CArimo%7CArizonia%7CArmata%7CArtifika%7CArvo%7CArya%7CAsap%7CAsar%7CAsset%7CAssistant%7CAstloch%7CAsul%7CAthiti%7CAtma%7CAtomic+Age%7CAubrey%7CAudiowide%7CAutour+One%7CAverage%7CAverage+Sans%7CAveria+Gruesa+Libre%7CAveria+Libre%7CAveria+Sans+Libre%7CAveria+Serif+Libre%7CBad+Script%7CBaloo%7CBaloo+Bhai%7CBaloo+Da%7CBaloo+Thambi%7CBalthazar%7CBangers%7CBasic%7CBattambang%7CBaumans%7CBayon%7CBelgrano%7CBelleza%7CBenchNine%7CBentham%7CBerkshire+Swash%7CBevan%7CBigelow+Rules%7CBigshot+One%7CBilbo%7CBilbo+Swash+Caps%7CBioRhyme%7CBioRhyme+Expanded%7CBiryani%7CBitter%7CBlack+Ops+One%7CBokor%7CBonbon%7CBoogaloo%7CBowlby+One%7CBowlby+One+SC%7CBrawler%7CBree+Serif%7CBubblegum+Sans%7CBubbler+One%7CBuda%7CBuenard%7CBungee%7CBungee+Hairline%7CBungee+Inline%7CBungee+Outline%7CBungee+Shade%7CButcherman%7CButterfly+Kids%7CCabin%7CCabin+Condensed%7CCabin+Sketch%7CCaesar+Dressing%7CCagliostro%7CCairo%7CCalligraffitti%7CCambay%7CCambo%7CCandal%7CCantarell%7CCantata+One%7CCantora+One%7CCapriola%7CCardo%7CCarme%7CCarrois+Gothic%7CCarrois+Gothic+SC%7CCarter+One%7CCatamaran%7CCaudex%7CCaveat%7CCaveat+Brush%7CCedarville+Cursive%7CCeviche+One%7CChanga%7CChanga+One%7CChango%7CChathura%7CChau+Philomene+One%7CChela+One%7CChelsea+Market%7CChenla%7CCherry+Cream+Soda%7CCherry+Swash%7CChewy%7CChicle%7CChivo%7CChonburi%7CCinzel%7CCinzel+Decorative%7CClicker+Script%7CCoda%7CCoda+Caption%7CCodystar%7CCoiny%7CCombo%7CComfortaa%7CComing+Soon%7CConcert+One%7CCondiment%7CContent%7CContrail+One%7CConvergence%7CCookie%7CCopse%7CCorben%7CCormorant%7CCormorant+Garamond%7CCormorant+Infant%7CCormorant+SC%7CCormorant+Unicase%7CCormorant+Upright%7CCourgette%7CCousine%7CCoustard%7CCovered+By+Your+Grace%7CCrafty+Girls%7CCreepster%7CCrete+Round%7CCrimson+Text%7CCroissant+One%7CCrushed%7CCuprum%7CCutive%7CCutive+Mono%7CDamion%7CDancing+Script%7CDangrek%7CDavid+Libre%7CDawning+of+a+New+Day%7CDays+One%7CDekko%7CDelius%7CDelius+Swash+Caps%7CDelius+Unicase%7CDella+Respira%7CDenk+One%7CDevonshire%7CDhurjati%7CDidact+Gothic%7CDiplomata%7CDiplomata+SC%7CDomine%7CDonegal+One%7CDoppio+One%7CDorsa%7CDosis%7CDr+Sugiyama%7CDroid+Sans%7CDroid+Sans+Mono%7CDroid+Serif%7CDuru+Sans%7CDynalight%7CEB+Garamond%7CEagle+Lake%7CEater%7CEconomica%7CEczar%7CEk+Mukta%7CEl+Messiri%7CElectrolize%7CElsie%7CElsie+Swash+Caps%7CEmblema+One%7CEmilys+Candy%7CEngagement%7CEnglebert%7CEnriqueta%7CErica+One%7CEsteban%7CEuphoria+Script%7CEwert%7CExo%7CExo+2%7CExpletus+Sans%7CFanwood+Text%7CFarsan%7CFascinate%7CFascinate+Inline%7CFaster+One%7CFasthand%7CFauna+One%7CFederant%7CFedero%7CFelipa%7CFenix%7CFinger+Paint%7CFira+Mono%7CFira+Sans%7CFjalla+One%7CFjord+One%7CFlamenco%7CFlavors%7CFondamento%7CFontdiner+Swanky%7CForum%7CFrancois+One%7CFrank+Ruhl+Libre%7CFreckle+Face%7CFredericka+the+Great%7CFredoka+One%7CFreehand%7CFresca%7CFrijole%7CFruktur%7CFugaz+One%7CGFS+Didot%7CGFS+Neohellenic%7CGabriela%7CGafata%7CGalada%7CGaldeano%7CGalindo%7CGentium+Basic%7CGentium+Book+Basic%7CGeo%7CGeostar%7CGeostar+Fill%7CGermania+One%7CGidugu%7CGilda+Display%7CGive+You+Glory%7CGlass+Antiqua%7CGlegoo%7CGloria+Hallelujah%7CGoblin+One%7CGochi+Hand%7CGorditas%7CGoudy+Bookletter+1911%7CGraduate%7CGrand+Hotel%7CGravitas+One%7CGreat+Vibes%7CGriffy%7CGruppo%7CGudea%7CGurajada%7CHabibi%7CHalant%7CHammersmith+One%7CHanalei%7CHanalei+Fill%7CHandlee%7CHanuman%7CHappy+Monkey%7CHarmattan%7CHeadland+One%7CHeebo%7CHenny+Penny%7CHerr+Von+Muellerhoff%7CHind%7CHind+Guntur%7CHind+Madurai%7CHind+Siliguri%7CHind+Vadodara%7CHoltwood+One+SC%7CHomemade+Apple%7CHomenaje%7CIM+Fell+DW+Pica%7CIM+Fell+DW+Pica+SC%7CIM+Fell+Double+Pica%7CIM+Fell+Double+Pica+SC%7CIM+Fell+English%7CIM+Fell+English+SC%7CIM+Fell+French+Canon%7CIM+Fell+French+Canon+SC%7CIM+Fell+Great+Primer%7CIM+Fell+Great+Primer+SC%7CIceberg%7CIceland%7CImprima%7CInconsolata%7CInder%7CIndie+Flower%7CInika%7CInknut+Antiqua%7CIrish+Grover%7CIstok+Web%7CItaliana%7CItalianno%7CItim%7CJacques+Francois%7CJacques+Francois+Shadow%7CJaldi%7CJim+Nightshade%7CJockey+One%7CJolly+Lodger%7CJomhuria%7CJosefin+Sans%7CJosefin+Slab%7CJoti+One%7CJudson%7CJulee%7CJulius+Sans+One%7CJunge%7CJura%7CJust+Another+Hand%7CJust+Me+Again+Down+Here%7CKadwa%7CKalam%7CKameron%7CKanit%7CKantumruy%7CKarla%7CKarma%7CKatibeh%7CKaushan+Script%7CKavivanar%7CKavoon%7CKdam+Thmor%7CKeania+One%7CKelly+Slab%7CKenia%7CKhand%7CKhmer%7CKhula%7CKite+One%7CKnewave%7CKotta+One%7CKoulen%7CKranky%7CKreon%7CKristi%7CKrona+One%7CKumar+One%7CKumar+One+Outline%7CKurale%7CLa+Belle+Aurore%7CLaila%7CLakki+Reddy%7CLalezar%7CLancelot%7CLateef%7CLato%7CLeague+Script%7CLeckerli+One%7CLedger%7CLekton%7CLemon%7CLemonada%7CLibre+Baskerville%7CLibre+Franklin%7CLife+Savers%7CLilita+One%7CLily+Script+One%7CLimelight%7CLinden+Hill%7CLobster%7CLobster+Two%7CLondrina+Outline%7CLondrina+Shadow%7CLondrina+Sketch%7CLondrina+Solid%7CLora%7CLove+Ya+Like+A+Sister%7CLoved+by+the+King%7CLovers+Quarrel%7CLuckiest+Guy%7CLusitana%7CLustria%7CMacondo%7CMacondo+Swash+Caps%7CMada%7CMagra%7CMaiden+Orange%7CMaitree%7CMako%7CMallanna%7CMandali%7CMarcellus%7CMarcellus+SC%7CMarck+Script%7CMargarine%7CMarko+One%7CMarmelad%7CMartel%7CMartel+Sans%7CMarvel%7CMate%7CMate+SC%7CMaven+Pro%7CMcLaren%7CMeddon%7CMedievalSharp%7CMedula+One%7CMeera+Inimai%7CMegrim%7CMeie+Script%7CMerienda%7CMerienda+One%7CMerriweather%7CMerriweather+Sans%7CMetal%7CMetal+Mania%7CMetamorphous%7CMetrophobic%7CMichroma%7CMilonga%7CMiltonian%7CMiltonian+Tattoo%7CMiniver%7CMiriam+Libre%7CMirza%7CMiss+Fajardose%7CMitr%7CModak%7CModern+Antiqua%7CMogra%7CMolengo%7CMolle%7CMonda%7CMonofett%7CMonoton%7CMonsieur+La+Doulaise%7CMontaga%7CMontez%7CMontserrat%7CMontserrat+Alternates%7CMontserrat+Subrayada%7CMoul%7CMoulpali%7CMountains+of+Christmas%7CMouse+Memoirs%7CMr+Bedfort%7CMr+Dafoe%7CMr+De+Haviland%7CMrs+Saint+Delafield%7CMrs+Sheppards%7CMukta+Vaani%7CMuli%7CMystery+Quest%7CNTR%7CNeucha%7CNeuton%7CNew+Rocker%7CNews+Cycle%7CNiconne%7CNixie+One%7CNobile%7CNokora%7CNorican%7CNosifer%7CNothing+You+Could+Do%7CNoticia+Text%7CNoto+Sans%7CNoto+Serif%7CNova+Cut%7CNova+Flat%7CNova+Mono%7CNova+Oval%7CNova+Round%7CNova+Script%7CNova+Slim%7CNova+Square%7CNumans%7CNunito%7COdor+Mean+Chey%7COffside%7COld+Standard+TT%7COldenburg%7COleo+Script%7COleo+Script+Swash+Caps%7COpen+Sans%7COpen+Sans+Condensed%7COranienbaum%7COrbitron%7COregano%7COrienta%7COriginal+Surfer%7COswald%7COver+the+Rainbow%7COverlock%7COverlock+SC%7COvo%7COxygen%7COxygen+Mono%7CPT+Mono%7CPT+Sans%7CPT+Sans+Caption%7CPT+Sans+Narrow%7CPT+Serif%7CPT+Serif+Caption%7CPacifico%7CPalanquin%7CPalanquin+Dark%7CPaprika%7CParisienne%7CPassero+One%7CPassion+One%7CPathway+Gothic+One%7CPatrick+Hand%7CPatrick+Hand+SC%7CPattaya%7CPatua+One%7CPavanam%7CPaytone+One%7CPeddana%7CPeralta%7CPermanent+Marker%7CPetit+Formal+Script%7CPetrona%7CPhilosopher%7CPiedra%7CPinyon+Script%7CPirata+One%7CPlaster%7CPlay%7CPlayball%7CPlayfair+Display%7CPlayfair+Display+SC%7CPodkova%7CPoiret+One%7CPoller+One%7CPoly%7CPompiere%7CPontano+Sans%7CPoppins%7CPort+Lligat+Sans%7CPort+Lligat+Slab%7CPragati+Narrow%7CPrata%7CPreahvihear%7CPress+Start+2P%7CPridi%7CPrincess+Sofia%7CProciono%7CPrompt%7CProsto+One%7CProza+Libre%7CPuritan%7CPurple+Purse%7CQuando%7CQuantico%7CQuattrocento%7CQuattrocento+Sans%7CQuestrial%7CQuicksand%7CQuintessential%7CQwigley%7CRacing+Sans+One%7CRadley%7CRajdhani%7CRakkas%7CRaleway%7CRaleway+Dots%7CRamabhadra%7CRamaraja%7CRambla%7CRammetto+One%7CRanchers%7CRancho%7CRanga%7CRasa%7CRationale%7CRavi+Prakash%7CRedressed%7CReem+Kufi%7CReenie+Beanie%7CRevalia%7CRhodium+Libre%7CRibeye%7CRibeye+Marrow%7CRighteous%7CRisque%7CRoboto%7CRoboto+Condensed%7CRoboto+Mono%7CRoboto+Slab%7CRochester%7CRock+Salt%7CRokkitt%7CRomanesco%7CRopa+Sans%7CRosario%7CRosarivo%7CRouge+Script%7CRozha+One%7CRubik%7CRubik+Mono+One%7CRubik+One%7CRuda%7CRufina%7CRuge+Boogie%7CRuluko%7CRum+Raisin%7CRuslan+Display%7CRusso+One%7CRuthie%7CRye%7CSacramento%7CSahitya%7CSail%7CSalsa%7CSanchez%7CSancreek%7CSansita+One%7CSarala%7CSarina%7CSarpanch%7CSatisfy%7CScada%7CScheherazade%7CSchoolbell%7CScope+One%7CSeaweed+Script%7CSecular+One%7CSevillana%7CSeymour+One%7CShadows+Into+Light%7CShadows+Into+Light+Two%7CShanti%7CShare%7CShare+Tech%7CShare+Tech+Mono%7CShojumaru%7CShort+Stack%7CShrikhand%7CSiemreap%7CSigmar+One%7CSignika%7CSignika+Negative%7CSimonetta%7CSintony%7CSirin+Stencil%7CSix+Caps%7CSkranji%7CSlabo+13px%7CSlabo+27px%7CSlackey%7CSmokum%7CSmythe%7CSniglet%7CSnippet%7CSnowburst+One%7CSofadi+One%7CSofia%7CSonsie+One%7CSorts+Mill+Goudy%7CSource+Code+Pro%7CSource+Sans+Pro%7CSource+Serif+Pro%7CSpace+Mono%7CSpecial+Elite%7CSpicy+Rice%7CSpinnaker%7CSpirax%7CSquada+One%7CSree+Krushnadevaraya%7CSriracha%7CStalemate%7CStalinist+One%7CStardos+Stencil%7CStint+Ultra+Condensed%7CStint+Ultra+Expanded%7CStoke%7CStrait%7CSue+Ellen+Francisco%7CSuez+One%7CSumana%7CSunshiney%7CSupermercado+One%7CSura%7CSuranna%7CSuravaram%7CSuwannaphum%7CSwanky+and+Moo+Moo%7CSyncopate%7CTangerine%7CTaprom%7CTauri%7CTaviraj%7CTeko%7CTelex%7CTenali+Ramakrishna%7CTenor+Sans%7CText+Me+One%7CThe+Girl+Next+Door%7CTienne%7CTillana%7CTimmana%7CTinos%7CTitan+One%7CTitillium+Web%7CTrade+Winds%7CTrirong%7CTrocchi%7CTrochut%7CTrykker%7CTulpen+One%7CUbuntu%7CUbuntu+Condensed%7CUbuntu+Mono%7CUltra%7CUncial+Antiqua%7CUnderdog%7CUnica+One%7CUnifrakturCook%7CUnifrakturMaguntia%7CUnkempt%7CUnlock%7CUnna%7CVT323%7CVampiro+One%7CVarela%7CVarela+Round%7CVast+Shadow%7CVesper+Libre%7CVibur%7CVidaloka%7CViga%7CVoces%7CVolkhov%7CVollkorn%7CVoltaire%7CWaiting+for+the+Sunrise%7CWallpoet%7CWalter+Turncoat%7CWarnes%7CWellfleet%7CWendy+One%7CWire+One%7CWork+Sans%7CYanone+Kaffeesatz%7CYantramanav%7CYatra+One%7CYellowtail%7CYeseva+One%7CYesteryear%7CYrsa%7CZeyada&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c46b18a1ccba221be436881e1649ef1bfd1e656184fcd535e84bc77c77e8e5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.redpacketsecurity.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 19:48:28 GMT
x-content-type-options: nosniff
age: 498922
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17912
x-xss-protection: 0
last-modified: Tue, 23 Aug 2022 17:55:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Sep 2023 19:48:28 GMT

GET
H3 200 fa-brands-400.woff2
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/webfonts/ 73 KB
74 KB 105ms
105ms Font
font/woff2 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/webfonts/fa-brands-400.woff2

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/all.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

fe85646af222500a866fd63beedb6ae00576c4afab4e0d28b15d9d6d92cb7da5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/all.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34
Origin: https://www.redpacketsecurity.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 74760
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: "62a9cb44-12408"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N7ppK9gyDohoCc%2Bo13q%2BMY4ATTmYClkz143qpeqdTwGvCRjttM1BbiW6bTZHPShV61Tz%2Bsq65EskQHbXlHEKly0O7BWW3MUhWLkQRDK8oFOmtQhJjUmD7Hq6ZOjCZhpCCLI1Itb9mELebv80yLPbEs36mbN6ISw%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=43200
accept-ranges: bytes
cf-ray: 74994da3ef4e3747-MXP

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 140ms
55ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat%3A400%2C500%2C700%2C800%7CWork%2BSans%3A300%2C400%2C500%2C600%2C700%2C800%2C900%26display%3Dswap&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.redpacketsecurity.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 03:24:20 GMT
x-content-type-options: nosniff
age: 385170
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Sep 2023 03:24:20 GMT

GET
H3 200 fa-solid-900.woff2
www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/webfonts/ 74 KB
74 KB 99ms
99ms Font
font/woff2 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/webfonts/fa-solid-900.woff2

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/all.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

e348d772480f8c0e5fa546b3c531a38700ae16b5dad5defb5e67ade7f6d332e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/css/font-awesome/css/all.min.css?ver=7bed2a0a462ca0c51f0127f71deaac34
Origin: https://www.redpacketsecurity.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 75392
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: "62a9cb44-12680"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FsFwL94vytwKvcmCRzbaQUX09GyF%2F9Bb6bUWBgS%2F6xH3VjHjgK74uqLmOEbTfCLcDYxwddsprnHGvR0jkWU9vhkce4PK64o9lTuZiN9Z%2F1g98xenc9ZjjzJPqHjV2ndDZrGmX7MRWkzWjAih3h01NZEsG%2BXWtN8%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=43200
accept-ranges: bytes
cf-ray: 74994da40f843747-MXP

GET
H3 200 Cobalt-Strike.jpg
www.redpacketsecurity.com/wp-content/uploads/2021/11/ 145 KB
146 KB 78ms
78ms Image
image/jpeg 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2021/11/Cobalt-Strike.jpg

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

00ab36d5573ceab85b1bc2de3ff62f4a9402bdc7c8a9749ac58c7037aa4bd2b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=hIi82aDdewRAx8pvV7rZmnd_dO5g5.MJweNy1cX2xiU-1662992630-0-AQ9RSgJXWVnjnEHYti3L3EQFSvbryUqAldHKqwx0cP1nRoCEUkVAWcIW8N7ptXPS5YqFURZeZ5yxkPPuKvMxcs_wNzhQQVXzTIdhN74w-iEq; report-to cf-csp-endpoint
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 148817
last-modified: Tue, 09 Nov 2021 23:11:50 GMT
server: cloudflare
etag: "618b0036-25696"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BkWsAqtNPcFZnOt3ihaPEAnZl03BS%2BQ6MPnfCUtOgA7OgNP0xvpFZ04jvUHjwJ68mOk2vhfSZClgutHqxYnmSAzbhqlhrb%2FdiBrThp6z9RJhorCa9x9UUUv7OoG0i0SpEnPJJ5MbccqDlROsdUqb8ra5RCDQg3E%3D"}],"group":"cf-nel","max_age":604800}, {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=hIi82aDdewRAx8pvV7rZmnd_dO5g5.MJweNy1cX2xiU-1662992630-0-AQ9RSgJXWVnjnEHYti3L3EQFSvbryUqAldHKqwx0cP1nRoCEUkVAWcIW8N7ptXPS5YqFURZeZ5yxkPPuKvMxcs_wNzhQQVXzTIdhN74w-iEq"}],"group":"cf-csp-endpoint","max_age":86400}
content-type: image/jpeg
cache-control: max-age=43200
cf-polished: origSize=153238, status=webp_bigger
accept-ranges: bytes
cf-ray: 74994da42fb73747-MXP
cf-bgj: imgq:100,h2pri

GET
H3 200 custom-time.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 190 B
715 B 57ms
56ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/custom-time.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

878507828632957a2a0e471f1bfef8ef64ee4726f7fd03d05d77664823079fa5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"f9-5e17b59d6f323-gzip"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ilotwh1q6NlD5BqwNhY5YPVxU7NmQVVcRtQvoRpqw%2BSnYTiQHEuQ4aCS8pGaMsm6VJYX9Kgn73lLINW6GMjwdS9gZygsempqB7U0GGKF7ESuVufDuk0ZNaMsrNYaDUblQrALwtX2kWmgvpA%2FSW4%2BtVmqT2hNpd0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=43200
cf-polished: origSize=249
cf-ray: 74994da458243747-MXP
cf-bgj: minify

GET
H3 200 custom.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 3 KB
1 KB 74ms
67ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/custom.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

c6e098655bf365af10393cec5be569becfba92d4b3374f5f409ceaa5a3b3bad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-13ca"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eC409u%2FkgsvaZhVkPwsz13%2FFw2v5OA%2BlkExBq1wkYPPcWypUOF1wLLfNxLo01uh1ach989xY%2FZUO6C66K0KxwJs%2Bf1JpAdxiDDKL75R7GYnmCgSmb79fij%2BvRUaOvNupC8dncN5BV0%2BXXNbp5LjSLhsYtuQTZhQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=5066
cf-ray: 74994da468353747-MXP
cf-bgj: minify

GET
H3 200 smush-lazy-load.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/js/ 8 KB
4 KB 91ms
83ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.11.1

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

b30169a38c7ecd17eefc119177c0c61337b17a8f1abfd337ac37284d1a04a65b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 26 Aug 2022 09:58:13 GMT
server: cloudflare
etag: W/"63089935-1eee"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yEuWSiUQ6r1xKHHFf97IHulWmTr04X1XuJsm2WpCJEazyAJE71gM3SlvdUlWRU8Hn%2BQsqyZ3cS%2FoxbltO2x2qpxOnfzBYFO4gllkOXbojvLiifJpEBXy8rymIBIteX%2ByuyQuKVTuHBpffWDEjGvccykdSPtS%2FpA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468383747-MXP

GET
H3 200 product-image-preview.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/ 3 KB
1 KB 64ms
56ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/product-image-preview.min.js?ver=1.0.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

e8dfa93e316db0c0dd5d74f51997783f3517b8db6c7fa2461898ae5109c0b429

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 13 Jun 2022 19:27:37 GMT
server: cloudflare
etag: W/"62a78fa9-a19"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxQFQB3SMRPODLmFLIp8n8%2Fc7fzFPHx01y6HtsvDx6FFhexlBLEpwQsVUH7sHRc0AC%2BBiKOGQ9jBYuNNsDo0AwjlqGCtn4BcbxirJBd%2BkLVRd8eeb9WwmoY8Tzyl1qSxyoCKdenBH61pxa4gdQdA05EKGDiaqRM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da4683b3747-MXP

GET
H3 200 product-tooltip.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/ 1 KB
1 KB 60ms
53ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/template/_common/js/product-tooltip.min.js?ver=1.0.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

b9983e0f3bd212e1f920657c96ca9b0f3ef62e4b6ebbd153abd0f1791ecac4a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 13 Jun 2022 19:27:37 GMT
server: cloudflare
etag: W/"62a78fa9-4c9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JSPWMtnUgIx4%2FbYnVEp8%2B30kc5lrxlugWYtQc3DHcho3vDRazOPLAiJS92lUChGNS%2Bg%2BO8iKNbRzPaFxtvJStF%2BckbulgT%2FQ%2FSTxlNHejlwBTsEt7Dowf0DIWc%2BoxtVN%2FFTCFkfRLdcVzaugN8W2Ph8%2BPjEy6F8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da4683e3747-MXP

GET
H3 200 pointer-tooltip.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/main/asset/js/ 597 B
864 B 65ms
58ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/main/asset/js/pointer-tooltip.min.js?ver=5.2.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

629a298422d20d6be3aad025c6ddce8681991408627b1bf76f3e88abce039d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 13 Jun 2022 19:27:39 GMT
server: cloudflare
etag: W/"255-5e15947fc1074-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fpBROeZCDWBFpgzGZeYwwA7A9WRalZxRa7bwBUU6dcN28zTbzHSyv88ksIDEJ3e1AfPHJ3x2o0AEdX9Yx0Fk%2BFLWubE5R%2BYeoOwRXfy9Jlfm5AhaWt8ieqlcKbS5U3iSpeHoW1OHvnbk46U9r9r2UqLhWwQ5Rs4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=43200
cf-ray: 74994da468413747-MXP

GET
H3 200 wp-pointer.min.js Show response
www.redpacketsecurity.com/wp-includes/js/ 4 KB
2 KB 86ms
79ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/wp-pointer.min.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

7688d6c0bc721a9708d4f280bfc926b6bb25e2386300a906a7fe5fa31a334bc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 28 May 2022 21:05:44 GMT
server: cloudflare
etag: W/"62928ea8-e25"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3WRpGOgPCV4EJqn4jOvP65%2Bct7vNxWEdTUR5yougm1EGQTf58fVX%2FEHc0M1gr8CaO57Glg4Zk6LYQy47Pn02h4%2FzB8muQ2%2BkXYCttrpMdMJcY3XP7iuLHj6Tw5VlK2zndEJKxJ6EmjtyweoWhYPKmi6gj1imriA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468433747-MXP

GET
H3 200 i18n.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/ 10 KB
4 KB 62ms
55ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

1dc4b29dd0acbed77ec2fd81036c33efd4ab5989e8182705a30615a00a0117f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 28 May 2022 21:05:44 GMT
server: cloudflare
etag: W/"62928ea8-27ee"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gjTDuhA9fepwYgZDemKVhNjyNFYW9NGteNJksHWEOVOWDpGY1bQdr%2BLREnAMrLAoPWs%2FNc2X2XbFvIMWIJj6Bi23QkSMaJwuavSxsinxyqKazHYl3KPjIVp80G1NB3B%2FaZ36gcnBxK%2FKfOdE4EuLS7gSWqx%2BzOo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468453747-MXP

GET
H3 200 hooks.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/ 5 KB
2 KB 56ms
49ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 28 May 2022 21:05:44 GMT
server: cloudflare
etag: W/"62928ea8-132e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FxYA3Bx0SPlTUSdgtD40P2S4PH9XSUlDgyspBYJXc9ex5puL0pAjDh6Eisqwz8YuvUkxuYCDOGz3TrPL2avdSrLJ3zDwstfZYR8Zz7Lbv7fx6N%2BLtBMrjDRu5c0lVk0MOffbTjcoAS7KKnJBxmsKVlJy4agh8f8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468473747-MXP

GET
H3 200 wp-polyfill.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/vendor/ 19 KB
8 KB 60ms
54ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

6fecb89a29ee2bd397bb1bf58ecaa530a76f0654db71fadefd3cc70b0bc302bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 28 May 2022 21:05:44 GMT
server: cloudflare
etag: W/"62928ea8-4ac6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WPiuQp3pSGcrD0b0glLfkqD%2Bt97iB%2FlgFbPtOts%2FsufRy0dYXQeqOc88Xo2DcTl5yvmEQRbJyZ7C4h9CcHsaGlLXZfomiNcN3bcC9VaDJmMChHyVh87jt9poP5Uib2d6JmS%2B6xJg225ZJUbvchD5zpqMBi80p8k%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468483747-MXP

GET
H3 200 regenerator-runtime.min.js Show response
www.redpacketsecurity.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 55ms
49ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 28 May 2022 21:05:44 GMT
server: cloudflare
etag: W/"62928ea8-194b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P1WoCr4Q%2FxERkU%2FfQt84Z4hu%2FZdFH9SxeuLqFfIIhykFsT2%2BTczDreuaEAClIpbomJE4bTe%2FBpj35qKqE2n1YsBgD2WousT3AXSdSFI6Kkq1u24bdS%2BNTSVyi%2BH8jzHiFvDHUDckBrqrhtxtiRYmW7lHBGIN1n8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da4684b3747-MXP

GET
H3 200 core.min.js Show response
www.redpacketsecurity.com/wp-includes/js/jquery/ui/ 20 KB
7 KB 56ms
49ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 28 May 2022 21:05:44 GMT
server: cloudflare
etag: W/"62928ea8-50eb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bv3LHzdn4PDkB2XC3mx8Bqjk6xhuTz5x2B9pSG7%2B1HvJuK0FCLPFDA3HPRVNw17v%2B6RDFaBp0aqmaZIer4JW6%2F%2F3re7hRnHINhRrZqrFmV5LPkSdp%2Btxd9En1Tl1%2BGnNQ%2BT0YKn31JA0FSNEU5hNKUzyI3c4u0c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da4684c3747-MXP

GET
H3 200 now-retrieving-updater.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/component/unit/asset/js/ 3 KB
2 KB 57ms
50ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/component/unit/asset/js/now-retrieving-updater.min.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

62192a35a334d4401e348cf6774b25795b248972e116befa3405d9b9128a5473

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 13 Jun 2022 19:27:39 GMT
server: cloudflare
etag: W/"62a78fab-bd5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2FSKFB6ifIACgdlATGgFq4u9NdqVZlWEZoBVqndjOJpsSzQomw8MeI3kplRem5agfZH%2Bd29oMgXf5%2BxQxjiuYhfMIkF04OTXkgNMSPsaRaEnA9lez1AsJC25eva85ZEPfWUgJmP%2Fnvtyj%2BP7Uk6jXHrjrmj0UeU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468503747-MXP

GET
H3 200 iframe-height-adjuster.min.js Show response
www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/main/asset/js/ 3 KB
2 KB 72ms
66ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/amazon-auto-links/include/core/main/asset/js/iframe-height-adjuster.min.js?ver=5.2.9

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

54cb0643a7f536436b00df60b5bf7d1c37f71d9cca5bc05246f958a2573d0fa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 13 Jun 2022 19:27:39 GMT
server: cloudflare
etag: W/"62a78fab-c5d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z3uPn2FxYF2tzNNF1PLRmJ2p4AVNbMOJuyT8lzKNFpGZyp8lWYv8BshmbodVGQd4rww8ETLG%2FlYBqEMvO%2F8kg8kjeA92WII2jCIfZbD7H1x69rkcRY%2BqGRBRIsQvJHfTcSlmhi%2FJ8xP9RGv7PtYwv9757i5qFco%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468513747-MXP

GET
H3 200 app.js Show response
www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/js/ 244 B
742 B 63ms
57ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/patreon-connect/assets/js/app.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

7d45256c95c1c245654bf298e27d9c538dc778a2ee050ba4678ac2a07f479869

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 05 Jul 2022 20:38:48 GMT
server: cloudflare
etag: W/"162-5e314d6ef13d1-gzip"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=05SRDeG4OhujNkCeYiELQQQ1P5xh7wwcqz4Dv7LbSSbcgoFjCb%2BpUDhSsB82KLShorq%2FrIggMlB51I1PhNodFpaw0f4T9qWgSC6m2M09c0G70WaUkcTmhVKEI5hPIPeJpmVFEZ4Dpoke7Ua9tTYX8NRYDukWJhA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=43200
cf-polished: origSize=354
cf-ray: 74994da468563747-MXP
cf-bgj: minify

GET
H2 200 widget.js Show response
comments.app/js/ 9 KB
3 KB 167ms
39ms Script
application/javascript 149.154.164.13
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/js/widget.js?2

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

149.154.164.13 London, United Kingdom, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

482f450b7fdbac6f9304643f3e731df20bf66c51fb0599fa9a734e5d102a9e2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: gzip
last-modified: Fri, 19 Jun 2020 23:54:45 GMT
server: nginx/1.20.1
etag: W/"5eed5045-2390"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 165 KB
57 KB 166ms
85ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1536334219562771

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff63db6d5d33a23abed01b2ce8ea4745bada82996fcfe8c92b9313fc505024f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Origin: https://www.redpacketsecurity.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57550
x-xss-protection: 0
server: cafe
etag: 8327487446312183561
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 12 Sep 2022 14:23:50 GMT

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 14 KB
5 KB 145ms
79ms Script
text/javascript 2606:4700:440e::6812:2fe6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 74994da4c887375c-MXP

GET
H3 200 a01b5086.js Show response
www.redpacketsecurity.com/wp-content/uploads/caos/ 205 KB
72 KB 64ms
58ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/caos/a01b5086.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

93ba08191a5ef1ce0034cf78e4d75f6dd285de83ece5068078061267d0931676

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 12 Sep 2022 06:05:02 GMT
server: cloudflare
etag: W/"631ecc0e-33830"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rzjrXlLBdlTsKKGLkvIpXcK%2BQzXK4GbsYsrluwrjhusz9ab8UGtV6iHsGRMograMj6ywlpkUkgj6TGKlryEoaSEgPkBBVGHJiD5SfqEY%2BEywmeLWyQsS%2Bcvx0zAm9mfHvpCFgZ3DGtm%2B3aLRE1jYgpHXVpzwefs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=210992
cf-ray: 74994da468593747-MXP
cf-bgj: minify

GET
H3 200 bootstrap-smartmenus.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 3 KB
2 KB 73ms
67ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/bootstrap-smartmenus.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

46489b4c55fb6dce029c4ebcaa74c9616a0a89dc3be3e0027d0113c698ed9968

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-177b"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1qW77Zb5s04OnV1pBVwziBEmxKe%2BFPW2hOxbYeJ5XyB2lBaYNPMSVlLp7jrkhxdQbX9%2BSXfg%2BfacVOo%2B21miKA9XdkL6%2BbyPfN%2ByQRygZOoeSfX3N0C5MwOCTWBOJj4x5ZIdECXQqFcVB0kMqDBE9wisGR%2B1%2FaY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=6011
cf-ray: 74994da4685b3747-MXP
cf-bgj: minify

GET
H3 200 jquery.smartmenus.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 28 KB
8 KB 73ms
68ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/jquery.smartmenus.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

4247183ff111bcf12affd18ba0da4a7a1ff0b4e7e491db67b9562b58d6a29c88

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-b62e"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HhAX5JUGpL%2FaGv5CBcV7QoicNn7bvv1W1AaEL7Kgd8aWS9iZInlLAWyb9l%2FXeoMiKRA8MQJl%2Bgqw4OT%2Fv1T4V8AeuCkq0I9Hl%2BiY4aYxWM%2Fdr%2BzIzwGQb4KeIrc7dp0SH51xwzfbxydNrZbMVg9JKJjTVl4gi1w%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=46638
cf-ray: 74994da4685d3747-MXP
cf-bgj: minify

GET
H3 200 main.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 314 B
751 B 74ms
69ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/main.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

9691e8c38e89f0117aa9aab7dc706fa84ff4c18279a0769cfd90579c897922c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"271-5e17b59d6f323-gzip"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eeIgfAGImVMHTDioVCz2zS4vRIwjFPe%2BBYpXk%2FnsaQqLTnepqv9varRF0yqfsUVJm3%2B9HmccmKM9wegv8F7ia%2BxJKwnJK2dgsjYUqeDxmQH%2F3QgcaZVzCCaadjpthQhLFzTQEKq8OxOmDyTjSqK3N8%2FtQmiBW6s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-accel-version: 0.01
cache-control: max-age=43200
cf-polished: origSize=625
cf-ray: 74994da4685f3747-MXP
cf-bgj: minify

GET
H3 200 jquery.marquee.min.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 9 KB
3 KB 73ms
68ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/jquery.marquee.min.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

f7ec795d6ca0df8d0083c41b1a57aed9a3500897442639a0c24999a749eed08a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-2383"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zgoBY3NXE%2FVWOAGWBNXmkWtJ3jElXSMI8XmDjWua8coPM8%2Ffc%2FnolEpUcc3OZQuebr%2Bj7XTsNuToq%2FMs6bOSSbFs7syVR68xlBYiPQZRn0TVg4znISMUG2H9hAN72392iN5kC5cnE62HChV24NIWWWeQj%2Bwd6qo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468613747-MXP

GET
H3 200 owl.carousel.min.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 23 KB
7 KB 76ms
71ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/owl.carousel.min.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

6c1e31700f68d1666de6b0992e89d413434707718bf729a472404029845bdbad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-5d80"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xcq99XIyL18700AymuKPxcAKmhXwtsA9HJUxya6VKAlWwxIct2%2BFEa08wMdPrdVif7Md6l7ZH7n5pZlq1u%2BSCiDelwXnfJxEBiCgYvgEWeqczw91lxautZq6eqQ4%2F7FAGAfJAHr4y1%2FG561Rt4UvawhG3zVQIGE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468653747-MXP

GET
H3 200 bootstrap.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 88 KB
21 KB 147ms
142ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/bootstrap.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

da3e511b908f924d06bcd56a2274b737f070823715600c460dc5d593b276f961

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-22150"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nL26xeMHYyTsnwhuoS901CbXTVXspprqI0BaIDYPYRU0i%2F0PJ5e42DtdyTUGaTC5kjvRrEhopJkiswkZOQP%2BEDPRigj5VJlb32DUa6gx18qRi7qM94RuT6TSt14CLKVtHg44wsDOUKTe1bUJBbxkcCpawTujFlo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=139600
cf-ray: 74994da468663747-MXP
cf-bgj: minify

GET
H3 200 navigation.js Show response
www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/ 1 KB
1023 B 154ms
148ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/themes/newsup-pro/js/navigation.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

975fcd769077c94bff0b689fbe3ad59e461ea7c948870bd979d21ad4716ecee9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 15 Jun 2022 12:06:28 GMT
server: cloudflare
etag: W/"62a9cb44-938"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3kLweLvzUIr0Mclp5kLzdBrv9uZ2XwdJQh5GE44PoyNEcevaJABgkJ8LaDzCUceDR4eA%2FBTQOPb7Au1Nx4Txc%2B51kMZPVfELjBphky0VGyuFz3de3ELWxSwEbbTBTU6O73XVFjYuGZB9UFG9LfT2kZblXAb1pTQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=2360
cf-ray: 74994da468673747-MXP
cf-bgj: minify

GET
H3 200 jquery-migrate.min.js Show response
www.redpacketsecurity.com/wp-includes/js/jquery/ 11 KB
5 KB 76ms
71ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 22 Dec 2020 15:30:09 GMT
server: cloudflare
etag: W/"5fe21101-2bd8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZzO0V9RTUcAWKwgPcqNOGfZQ7ukqbK08AVtz%2BPI%2BfZcTRkoP2tdNLzqoLQ5BOU5fowhfaay%2Ba0jEY694J%2FZnp0eauy0rAlp77kuD9EsDs63LhgTxAtERhZJPpHuEpbLSBT51kAKd1ZbmjUev8PuIqtBTZ6GYbj4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da468683747-MXP

GET
H3 200 jquery.min.js Show response
www.redpacketsecurity.com/wp-includes/js/jquery/ 87 KB
32 KB 83ms
78ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 28 Jul 2021 06:20:01 GMT
server: cloudflare
etag: W/"6100f711-15db1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xx0jtuFAudNi0mp2awImXPte%2F%2FAPyHRYGY9T5hu5ZNy3PJmdlJkkqB%2BFLb1K4yger8EzZLJM27r9vb4m63tDovzBZtfupzqTSlNK32%2BSy0BYGHFaQWXB9WrmEU2NXwBu77cwyOQqZKu1D5J3NOKOTCPBOq%2Btejk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da4686a3747-MXP

GET
H3 200 invisible.js Show response
www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame ABF8 37 KB
14 KB 53ms
50ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662984000
Requested by: Host: t.co
URL: https://t.co/3tt2kxWiPY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c3e4ab5128dd3d93d7221f762a5603aca4b7bc685d2190628b243ebebd6f463

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S2M8cqYDtjZMLJYjZFopkU6K4h2mxfAKXbcz72IUoJV5i%2FSfQw5w0mmzd2JiSCNR%2FB8szB9RGuvi56VtxNrXJBFyxXYpUMoZ1qRK%2BGWViFnJV89XL7nVjMCwkknpqK8QicRiiclpbB4%2FzcfQ%2ByRMkjRZjokm86U%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 74994da4686c3747-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 s.js Show response
www.redpacketsecurity.com/cdn-cgi/zaraz/ 6 KB
3 KB 127ms
124ms Script
text/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/zaraz/s.js?z=JTdCJTIyZXhlY3V0ZWQlMjIlM0ElNUIlNUQlMkMlMjJ0JTIyJTNBJTIyQ29iYWx0JTIwU3Rpa2UlMjBCZWFjb24lMjBEZXRlY3RlZCUyMC0lMjAxNzklNUIuJTVENjAlNUIuJTVEMTQ2JTVCLiU1RDUxJTNBNDQzJTIwLSUyMFJlZFBhY2tldCUyMFNlY3VyaXR5JTIyJTJDJTIyeCUyMiUzQTAuMDYyNDU4MTg1NTc4NzU0MDQ0JTJDJTIydyUyMiUzQTE2MDAlMkMlMjJoJTIyJTNBMTIwMCUyQyUyMmolMjIlM0ExMjAwJTJDJTIyZSUyMiUzQTE2MDAlMkMlMjJsJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZ3d3cucmVkcGFja2V0c2VjdXJpdHkuY29tJTJGY29iYWx0LXN0aWtlLWJlYWNvbi1kZXRlY3RlZC0xNzktNjAtMTQ2LTUxLXBvcnQtNDQzJTJGJTIyJTJDJTIyciUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGdC5jbyUyRiUyMiUyQyUyMmslMjIlM0EyNCUyQyUyMm4lMjIlM0ElMjJVVEYtOCUyMiUyQyUyMm8lMjIlM0EwJTJDJTIycSUyMiUzQSU1QiU1RCU3RA==
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a144d17625e107b84cc33e980375f347a886c44cc806a438dd13322840a0f67a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: text/javascript
access-control-allow-origin: https://www.redpacketsecurity.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MTYjbiYQrz90AkaTX4LTKmAS82ha1IolhCejTmNpmsE7ZGgAg6z%2FA1SeEGBGUv0AUFGbk3lNNtnEeEOeSbovIMVK46jySnO8XTX74DfqjApTaKJWB%2FGxgC6z4i0ToVszT86ZRYD0NHnKe7SEr9TZD5pflHVweFk%3D"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 600
access-control-allow-credentials: true
cf-ray: 74994da4686e3747-MXP
access-control-allow-headers: Content-Type, Set-Cookie, Cache-Control
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 pica.js
www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame ABF8 21 KB
8 KB 35ms
31ms Other
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39515923a7a6d6b0fc527d9b4387b7eae4d1983ee8cdabadf214f01f9f633357

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bRQC88f%2F%2Fcl%2Bq6q82hru%2BvbFXyjVb4sGLJdl0jNfnmHmwZD0l1a2BLHBERZ%2B6id1bitWv7ARvR3XLgC9pJ%2FH0zRa%2FbnWZuQlQfqkdUJsjdHvo7hXLP%2BVnaDJ8sARweAwed4KMMI12nfiijCaC%2FEZQFGPN6O6qJc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 74994da4d95c3747-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2

200

/
www.google.it/pagead/1p-conversion/4209956877/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/4209956877/?guid=ON&random=1662992943496&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fc...
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecur...
https://www.google.com/pagead/1p-conversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stik...
https://www.google.it/pagead/1p-conversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike...

42 B
0

137ms
57ms

Fetch
image/gif

2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.it/pagead/1p-conversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ig=1&ref=https%3A%2F%2Ft.co%2F&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9kAfY63nK5CeywWUjICACg&cid=CAQSKQCsnQUxcYerox23ZjHZsWTUOhTtKBXgaiK0d11tBlfzvKcw_RATKfuR&random=25300607&ipr=y&prhg=0

Protocol

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:51 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.it/pagead/1p-conversion/4209956877/?guid=ON&random=1255314636&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ig=1&ref=https%3A%2F%2Ft.co%2F&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9kAfY63nK5CeywWUjICACg&cid=CAQSKQCsnQUxcYerox23ZjHZsWTUOhTtKBXgaiK0d11tBlfzvKcw_RATKfuR&random=25300607&ipr=y&prhg=0
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.it/pagead/1p-user-list/4209956877/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/4209956877/?guid=ON&random=1662992943496&fst=1662992630476&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketse...
https://www.google.com/pagead/1p-user-list/4209956877/?guid=ON&random=1662992943496&fst=1662991200000&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-st...
https://www.google.it/pagead/1p-user-list/4209956877/?guid=ON&random=1662992943496&fst=1662991200000&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-sti...

42 B
0

148ms
46ms

Fetch
image/gif

2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.it/pagead/1p-user-list/4209956877/?guid=ON&random=1662992943496&fst=1662991200000&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ref=https%3A%2F%2Ft.co%2F&is_vtc=1&random=3096382455&ipr=y

Protocol

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:51 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.it/pagead/1p-user-list/4209956877/?guid=ON&random=1662992943496&fst=1662991200000&cv=9&sendb=1&num=1&u_cd=24&u_java=false&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&tiba=Cobalt+Stike+Beacon+Detected+-+179%5B.%5D60%5B.%5D146%5B.%5D51%3A443+-+RedPacket+Security&u_tz=0&u_his=10&ref=https%3A%2F%2Ft.co%2F&is_vtc=1&random=3096382455&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 wp-emoji-release.min.js Show response
www.redpacketsecurity.com/wp-includes/js/ 18 KB
5 KB 43ms
43ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-includes/js/wp-emoji-release.min.js?ver=7bed2a0a462ca0c51f0127f71deaac34

Requested by

Host: t.co
URL: https://t.co/3tt2kxWiPY

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 28 May 2022 21:05:44 GMT
server: cloudflare
etag: W/"62928ea8-48b9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c692DJ8T3UOmV%2F3sSCHphms01OjjXcfhdZwbLu2RqmLEHbsDojXFVptCkCCsjlMy4QDhcPalNxWyp6FwgEldFVR9Dgw4W370UkK%2FBwD5aUVZ3nLDWLVNGd8pFFnWyQJSd5%2Bv6TE6uJRFZ9Ka894K7wPYKsKuSOs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 74994da55a9e3747-MXP

GET
H3 200 a01b5086.js Show response
www.redpacketsecurity.com/wp-content/uploads/caos/ 205 KB
72 KB 54ms
53ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/caos/a01b5086.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

93ba08191a5ef1ce0034cf78e4d75f6dd285de83ece5068078061267d0931676

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 12 Sep 2022 06:05:02 GMT
server: cloudflare
etag: W/"631ecc0e-33830"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R4u14jexSC38OaBzd3z%2FGYX56EI2CKRCDdTf3UH8v%2FcPjwzH9nxfd1UzV0Vjzg88CNZCWW8HO5N1rWJ%2Fi7Y5rIKkeGyh5nYjHrFXjcP%2BWQX6agjlC1WnjdTMDCPBjqaXsU96gM8nPefLNjqC6BZqj93nB7fosOo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=210992
cf-ray: 74994da59b043747-MXP
cf-bgj: minify

POST
H2 204 collect
analytics.google.com/g/ 0
354 B 141ms
41ms Ping
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-GN0W0LT7ZX&gtm=2oe970&_p=1455312046&_gaz=1&cid=61575201.1662992631&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1662992630&sct=1&seg=0&dl=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&dr=https%3A%2F%2Ft.co%2F&dt=Cobalt%20Stike%20Beacon%20Detected%20-%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443%20-%20RedPacket%20Security&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.site_speed_sample_rate=1
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/wp-content/uploads/caos/a01b5086.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:50 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.redpacketsecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
354 B 144ms
43ms Ping
text/plain 2a00:1450:400c:c07::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-GN0W0LT7ZX&cid=61575201.1662992631&gtm=2oe970&aip=1
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/wp-content/uploads/caos/a01b5086.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:50 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.redpacketsecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a01b5086.js Show response
www.redpacketsecurity.com/wp-content/uploads/caos/ 205 KB
72 KB 56ms
56ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/caos/a01b5086.js

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

93ba08191a5ef1ce0034cf78e4d75f6dd285de83ece5068078061267d0931676

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6779
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 12 Sep 2022 06:05:02 GMT
server: cloudflare
etag: W/"631ecc0e-33830"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tEMeL3cK9LPpa%2FzmqiYn2NHgN3EmB16jUbk56U24bioIQywmvnSSYJND8YFjnfrYxUh0sJtukL0xdPVRhFMq4l4V9mH2NS8WVOwNB%2FD2ao6fobIezzr8%2BKX9E85jqJBtZQNCpC4CdgnUQ3Hj%2BwnHb9zunFXHavo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-polished: origSize=210992
cf-ray: 74994da62c3b3747-MXP
cf-bgj: minify

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209070101/ 345 KB
122 KB 180ms
101ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1536334219562771&plah=www.redpacketsecurity.com&bust=31069447

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1536334219562771

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b6d6a3b14e178b8b51949af934301e746499da85565722ad3ec29a61d32b89c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124392
x-xss-protection: 0
server: cafe
etag: 9007068585356014248
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 12 Sep 2022 14:23:50 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220907/r20190131/ Frame C337 10 KB
4 KB 102ms
34ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220907/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1536334219562771

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 65524
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 20:11:46 GMT
etag: 8616628553774171045
expires: Sun, 25 Sep 2022 20:11:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view Show response
comments.app/embed/ Frame 3551 7 KB
3 KB 98ms
97ms Document
text/html 149.154.164.13
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Cobalt%20Stike%20Beacon%20Detected%20-%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443%20-%20RedPacket%20Security&limit=5&color=E22F38

Requested by

Host: comments.app
URL: https://comments.app/js/widget.js?2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

149.154.164.13 London, United Kingdom, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

e064f51bb41b701150f1fc3d2b77240b64367aa04f15c6df851b99b4875605ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cache-control: no-store
content-encoding: gzip
content-length: 2553
content-type: text/html; charset=utf-8
date: Mon, 12 Sep 2022 14:23:50 GMT
pragma: no-cache
server: nginx/1.20.1
strict-transport-security: max-age=31536000; includeSubDomains; preload

POST
H3 200 74994d9e0e6bbaff Show response
www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame ABF8 2 B
671 B 70ms
70ms XHR
text/plain 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/cv/result/74994d9e0e6bbaff
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662984000
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I5ArSGLDWs7jKr8FXlwBoZLgREEbgvuN3HuFchwYiR7QTxCcKgXlrj87NzcRamvR%2B8FxXexnvTgTlaJSMhlTMCTzTP0nVvht4knZdFSNM31WJn0vq6nJ7txZ5OkwnZEzhkpqurbiuxeTWJSxSj4xHG4uPRxfZH0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 74994da7afaa3747-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 css
fonts.googleapis.com/ Frame 3551 4 KB
621 B 128ms
44ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500

Requested by

Host: comments.app
URL: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Cobalt%20Stike%20Beacon%20Detected%20-%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443%20-%20RedPacket%20Security&limit=5&color=E22F38

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 13:02:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:51 GMT

GET
H2 200 bootstrap.min.css
tg.dev/css/ Frame 3551 42 KB
10 KB 129ms
39ms Stylesheet
text/css 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/css/bootstrap.min.css?3

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-a61b"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 bootstrap-extra.css
tg.dev/css/ Frame 3551 70 KB
13 KB 207ms
116ms Stylesheet
text/css 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/css/bootstrap-extra.css?2

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

6342d16a93416b5e826f6d0e0e930ef033efb682851ae46270f3c4f5b4a1c194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-11648"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 widget-frame.css
tg.dev/css/ Frame 3551 86 KB
22 KB 169ms
78ms Stylesheet
text/css 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/css/widget-frame.css?62

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

437e2f919345cdc64ce4cc4de32598b6c99b2962f3e209c4c2efe4eeb4db7971

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 15 Jul 2022 13:29:32 GMT
server: nginx/1.18.0
etag: W/"62d16bbc-157fd"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 comments.css
comments.app/css/ Frame 3551 83 KB
20 KB 81ms
78ms Stylesheet
text/css 149.154.164.13
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/css/comments.css?31

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

149.154.164.13 London, United Kingdom, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

e450af4a7c4974ea3ff324b629876380e0ca9605333a57152a953310c4a4661a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Cobalt%20Stike%20Beacon%20Detected%20-%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443%20-%20RedPacket%20Security&limit=5&color=E22F38
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 24 Jul 2020 12:57:13 GMT
server: nginx/1.20.1
etag: W/"5f1adaa9-14b98"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css

GET
H2 200 jquery.min.js Show response
tg.dev/js/ Frame 3551 94 KB
38 KB 208ms
119ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-1762a"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 jquery-ui.min.js Show response
tg.dev/js/ Frame 3551 96 KB
32 KB 245ms
156ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/jquery-ui.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

eb46d82ef6f86859f18e379660e0f45b85c6f69fa97111905f0c125a08506376

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-181a9"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 bootstrap.min.js Show response
tg.dev/js/ Frame 3551 31 KB
10 KB 205ms
117ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

b5e930df6a2976d5df996e18b347e091756699ea32716dc53d0e1c0fd814c526

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.18.0
etag: W/"5a05e7c6-7d0d"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 main-aj.js Show response
tg.dev/js/ Frame 3551 34 KB
10 KB 206ms
117ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/main-aj.js?58

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

e28b35a3da8773aebff732255cd50f4693c5bc2b6906f7a0d2b9f76060d0a2e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Fri, 03 Jun 2022 13:37:51 GMT
server: nginx/1.18.0
etag: W/"629a0eaf-88ea"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 tgsticker.js Show response
tg.dev/js/ Frame 3551 24 KB
7 KB 206ms
118ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/tgsticker.js?29

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

dd6e691a27d07125e04993917cfb3f75ac9d8926f6b66d7c2e45368aa130e660

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Wed, 29 Jun 2022 21:52:44 GMT
server: nginx/1.18.0
etag: W/"62bcc9ac-5faf"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 telegram-widget.js Show response
oauth.tg.dev/js/ Frame 3551 19 KB
6 KB 132ms
39ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://oauth.tg.dev/js/telegram-widget.js?19

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

60c62e0e44a2b4a1116d28f8a69f20c108cc84b5c173060d134a6ec083e12240

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Thu, 14 Apr 2022 10:47:14 GMT
server: nginx/1.18.0
etag: W/"6257fbb2-4a0b"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 widget-frame.js Show response
tg.dev/js/ Frame 3551 91 KB
25 KB 244ms
157ms Script
application/javascript 104.222.176.10
SEABONE-NET TELEC...

General

Check archive.org

Show headers Download Go to

Full URL

https://tg.dev/js/widget-frame.js?59

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.222.176.10 , United Kingdom, ASN6762 (SEABONE-NET TELECOM ITALIA SPARKLE S.p.A., IT),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

a3a9666403dd904811c01ba6925d89449b27aa3efe19e86b9d8864d660922fc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Thu, 14 Jul 2022 22:52:43 GMT
server: nginx/1.18.0
etag: W/"62d09e3b-16c7c"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
cache-control: max-age=345600
expires: Fri, 16 Sep 2022 14:23:51 GMT

GET
H2 200 comments.js Show response
comments.app/js/ Frame 3551 81 KB
22 KB 79ms
79ms Script
application/javascript 149.154.164.13
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://comments.app/js/comments.js?35

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

149.154.164.13 London, United Kingdom, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

aa441bf5f2ac8c608371513bad73ea45ad6dc8b7c50e3c6841af81147d0b96ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://comments.app/embed/view?website=S_Epbvwz&page_url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&origin=https%3A%2F%2Fwww.redpacketsecurity.com&page_title=Cobalt%20Stike%20Beacon%20Detected%20-%20179%5B.%5D60%5B.%5D146%5B.%5D51%3A443%20-%20RedPacket%20Security&limit=5&color=E22F38
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
last-modified: Tue, 17 Nov 2020 20:59:36 GMT
server: nginx/1.20.1
etag: W/"5fb439b8-142f4"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript

GET
H3 200 Redpacketsecurity-small-logo.png
www.redpacketsecurity.com/wp-content/uploads/2022/08/ 9 KB
10 KB 47ms
46ms Image
image/webp 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2022/08/Redpacketsecurity-small-logo.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

24edfcf6c3ff1d5bba9330be3f3e481b50962a9049c9b575e0040b13ad3dcd21

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
vary: Accept
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6780
x-powered-by: PleskLin
content-disposition: inline; filename="Redpacketsecurity-small-logo.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9552
last-modified: Tue, 09 Aug 2022 19:27:12 GMT
server: cloudflare
etag: "62f2b510-2857"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0HnUY1f%2FJejugkcrjTd60cfaYPX4l2McHNEt0%2Fft4oz7J%2BCfqL0a1KV9tbpu2H8n%2BTYHvfgBb%2F18JHpA0spFabpQzoY%2F8FIbq8bJk8q0RIJGQ3byYRUV%2FB%2Fg%2FGs%2F%2FiLcWVVywl6ewsSTNOuxXZd4FrW%2Flt8cefo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=43200
cf-polished: origFmt=png, origSize=10327
accept-ranges: bytes
cf-ray: 74994da8087e3747-MXP
cf-bgj: imgq:100,h2pri

GET
H3 200 n8n-banner.webp
www.redpacketsecurity.com/wp-content/uploads/2022/08/ 10 KB
10 KB 76ms
76ms Image
image/webp 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2022/08/n8n-banner.webp

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

ed2113aa9397e24527500bbb87bd9a0a2b014d1bd3a0da1aedd2ad1d53d88da6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6780
x-powered-by: PleskLin
strict-transport-security: max-age=15768000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9780
last-modified: Wed, 10 Aug 2022 21:24:50 GMT
server: cloudflare
etag: "62f42222-2634"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bcE8p0hhIuvzdZjhC%2BVPwhMF7ckIwMDEcH9x6QrA9gskQ3wTq3tZLPdvtNsf9hNe65r%2B7hEewmuJLCYqRKEHri%2BdZAy3hizhGHIBnk2qZpOujZ0NLxjGenMO0F7zu5H4uWRqOBaOcQ%2FlLu8anLzt1GYXjKF4gfA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=43200
accept-ranges: bytes
cf-ray: 74994da808823747-MXP

GET
H3 200 smush-placeholder.png
www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/images/ 136 B
778 B 53ms
52ms Image
image/webp 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/images/smush-placeholder.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

ae394bf43bc39f7c6b3f439de04f6b75288d849a0ecae5000a2452546063647c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
vary: Accept
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6780
x-powered-by: PleskLin
content-disposition: inline; filename="smush-placeholder.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 136
last-modified: Fri, 26 Aug 2022 09:58:13 GMT
server: cloudflare
etag: "3e3-5e721f3c31544"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yeUI29SWNYlT6nshC0uvZTE58HOQyo8%2FN17aKPsFhd3RcEToil%2Ff3yUgzi3i7uY71GOR5hL5NMGGJ3e5lnxg4%2F35Q89T6yvtWhW090yeCwzzp29fCo1OpdGvp2AQi5Kqtb6zAE3xxsJ2rg3A7a2ByH6nvoXafWE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
x-accel-version: 0.01
cache-control: max-age=43200
cf-polished: origFmt=png, origSize=995
accept-ranges: bytes
cf-ray: 74994da808833747-MXP
cf-bgj: imgq:100,h2pri

GET
H3 200 invisible.js Show response
www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame ABF8 37 KB
13 KB 36ms
35ms Script
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662984000
Requested by: Host: t.co
URL: https://t.co/3tt2kxWiPY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09007b83810c6282ed1a6e380c96d9c8b5f086edc0d619fecd40f9d4d805882b

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PWjBxAT3%2Bjv6%2Fd12pF%2BkdxGJLFEElMQ56%2Bw7j%2Bz1P7inkcfRswHqPU227upSpfS4NH%2F3F9ifLIehU9ektcIINo2zU7I7DfxfPKNPYbh76RMGDYaejq7ddTuo%2BX4uHG00zz7c4FBsw%2BLdmJ38gKF%2B3nAQazOW5aM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 74994da818953747-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 loading.gif
www.redpacketsecurity.com/wp-admin/images/ 1 KB
2 KB 157ms
157ms Image
image/gif 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-admin/images/loading.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

6d53299eeb9516dbba670ceeb55e8e5ce2186edb71518f6a1bd16553308f17c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 16 Jan 2020 19:35:16 GMT
server: cloudflare
x-powered-by: PleskLin
etag: "5e20baf4-55c"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oHZTWh3KpC9OIE%2FjmscClA6vvLhaIJ1qFASe8KCKZpMDQVmEmpPYRpdEZ01u15HJxyxSn%2FAjS%2BAJcS10JPAVb%2B4h36OvapIw7ViUx6RJ0XuKkq5tw41pcnFX3TbacRgQP60PYDUOe16fNVlT%2FSnxqTAugPB7T5s%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 74994da828da3747-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1372

POST
H3 200 rum Show response
www.redpacketsecurity.com/cdn-cgi/ 0
174 B 36ms
28ms XHR
text/plain 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.redpacketsecurity.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
content-type: application/json

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.redpacketsecurity.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 74994da838e13747-MXP
vary: Origin

GET
H3 200 pica.js
www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame ABF8 24 KB
9 KB 43ms
42ms Other
application/javascript 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9186fd23b9aae0b0f032ecc83f1a387b8e39fa4825e4245e981083f622c02482

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z%2Fs4iQTHNwqB48m4dxfrvbskTvJC79w%2Fvs7z30tYx%2FzV87%2FxtMPloU%2BnrAWDcBKhE6JbCtsSjkNfkWB7llj4PypbxQx8Usok19aa3L9Cx8ZBqEKuWMUzu0qWweeyF6Q0JXo%2F1OiYCEnD6XRsfugndMgk38kKi1c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 74994da859383747-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 225 B
653 B 152ms
41ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.redpacketsecurity.com&callback=_gfp_s_&client=ca-pub-1536334219562771

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209070101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1536334219562771&plah=www.redpacketsecurity.com&bust=31069447

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

4262de2c2742c8984c040473e241b03ece0e5103a42e2af7211d3edf14d4dc0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 209
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3551 694 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 76216b6c25b768e5bee4b758dacfef993b3e87cc2d7fd9bf192bd685d1ae9bfb

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 3551 706 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b28d8e93ecf9067ff746e514c79ad5adc53cc00965630bfe0b118cf80f7bf065

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
792 B 134ms
42ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 117ms
43ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F92A 281 KB
68 KB 556ms
554ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&adk=1812271804&adf=3025194257&lmt=1662862591&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630745&bpp=8&bdt=907&idt=345&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8234742624287&frm=20&pv=2&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=374

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aae40e723f2a24aa6da4a34cdfd46d7d9c8b43e7e67d8e6d34253c300059f008

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 69596
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 159ms
89ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220907&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41e6b6d767624abc8bc9186dbb7dc68dfa088257c84850b275c89e3fa6a7d44f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11193
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B281 77 KB
24 KB 387ms
386ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e137ed642ca3ffb83b012c58226864e4525807419ed4836c4621aee7087788b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 24986
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css2
fonts.googleapis.com/ Frame 3551 112 KB
29 KB 49ms
48ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=M+PLUS+Rounded+1c:wght@700&display=swap

Requested by

Host: tg.dev
URL: https://tg.dev/css/widget-frame.css?62

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f1c5e16c3abc728ef3c7eb1ff66fc5b15f08232156bae6493e37becbd1b2f01d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tg.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 13:23:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:51 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3551 16 KB
16 KB 139ms
45ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://comments.app
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 12:56:05 GMT
x-content-type-options: nosniff
age: 5266
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Sep 2023 12:56:05 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3551 15 KB
15 KB 140ms
47ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://comments.app
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 13:27:29 GMT
x-content-type-options: nosniff
age: 262582
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Sep 2023 13:27:29 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 134ms
54ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:51 GMT

GET
H3 200 Cobalt-Strike.jpg
www.redpacketsecurity.com/wp-content/uploads/2021/11/ 145 KB
146 KB 49ms
49ms Image
image/jpeg 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.redpacketsecurity.com/wp-content/uploads/2021/11/Cobalt-Strike.jpg

Requested by

Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.11.1

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PleskLin

Resource Hash

00ab36d5573ceab85b1bc2de3ff62f4a9402bdc7c8a9749ac58c7037aa4bd2b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 148817
last-modified: Tue, 09 Nov 2021 23:11:50 GMT
server: cloudflare
etag: "618b0036-25696"
strict-transport-security: max-age=15768000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NKEfTdSM1OMFPJauXyguS03I8X124noWJmQCduOwvnajxwjxh%2FpqzFfCWlyVG1IeGZcifcmYmkTQfUgT8aV%2BoO4RDJC7sWLWlQGt2tr1De2yjm0Ubvc9hHa1q0SmGvj5Z4H%2BM1lmRUBFt20mq%2BrQJER2vm8dbSc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=43200
cf-polished: origSize=153238, status=webp_bigger
accept-ranges: bytes
cf-ray: 74994da9dcad3747-MXP
cf-bgj: imgq:100,h2pri

POST
H3 200 74994d9e0e6bbaff Show response
www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame ABF8 2 B
678 B 47ms
47ms XHR
text/plain 2606:4700:20::ac43:4810
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/cv/result/74994d9e0e6bbaff
Requested by: Host: www.redpacketsecurity.com
URL: https://www.redpacketsecurity.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662984000
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4810 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qIaku80awe2GxCREkGzFzbpe%2BmUJ3A8TUM1Xw75ZgzwJguv8pH3i5wm%2BOiI2UH3wAzW%2FHJmz952TX1C09LLgdkMREQper8NJ9ByDp%2Fz8F5nK19SrXfd%2Fkm91GDqWlx7Y6jEcLv%2FVnC0zPWxM3Xkamrf1OKl%2BbtQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 74994daafeed3747-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F44D 13 KB
5 KB 132ms
45ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

accept-ranges: bytes
age: 3779
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 13:20:52 GMT
expires: Tue, 12 Sep 2023 13:20:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CA99 783 B
535 B 115ms
46ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0794a03109ae7d8466b5d5e2403efb4c9bfa56217912e28bf3fa611b9804da7d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yE_5edgPwlEMVzaxknQ85g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-yE_5edgPwlEMVzaxknQ85g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:51 GMT
expires: Mon, 12 Sep 2022 14:23:51 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 d9c3feb5dbeb38b81847ec1386e6162f.js Show response
www.gstatic.com/mysidia/ Frame B281 10 KB
5 KB 113ms
37ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d9c3feb5dbeb38b81847ec1386e6162f.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5cd3351a343011cbc0046d12c2b8bc8d7a968a09009ddb117fb1dc49fd1333

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100143
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4500
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H2 200 7035eec4e470f54a305d2f6275354b5f.js Show response
www.gstatic.com/mysidia/ Frame B281 10 KB
4 KB 114ms
39ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7035eec4e470f54a305d2f6275354b5f.js?tag=text/vanilla_highlight

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4fa2768879ae058b28e26435993114f2a868aa56a2ff051332a1beb6a409dce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100143
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4418
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame B281 8 KB
893 B 50ms
49ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 12:49:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:51 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame B281 2 KB
902 B 42ms
42ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:19:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:19:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame B281 23 KB
9 KB 122ms
43ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9632
x-xss-protection: 0
server: cafe
etag: 15013890920676311251
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame B281 3 KB
1 KB 45ms
43ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 340
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:11 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B281 141 KB
44 KB 118ms
43ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:51 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame B281 17 KB
7 KB 126ms
48ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:23:30 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame B281 0
0 44ms
42ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQWySTX8hYUtevLsfrmbKoIRat1PPisl_PqvqTao-q8N_Cy73DBY1GHIRmIO3RCx4_BCF-gaT7jbMyHK6PiqEOOgr0hag
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 8e474446b56ed6ef0feeec2d987f1a60.js Show response
www.gstatic.com/mysidia/ Frame B281 33 KB
13 KB 112ms
39ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8e474446b56ed6ef0feeec2d987f1a60.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84c1026e0a4c60ec0ee85c8b41c1904144aa63184260c95840924b42bd32d33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100154
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13628
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:37 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CA99 0
0 70ms
69ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220907&jk=261561337798831&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/11325930680005311225/ Frame B281 3 KB
3 KB 49ms
49ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11325930680005311225/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bc49569048b009b78cf88826f421495bafb16335cb08a68e8fcf9ece6954ad9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 07:14:33 GMT
x-content-type-options: nosniff
age: 544158
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3348
x-xss-protection: 0
last-modified: Fri, 13 May 2022 12:28:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 06 Sep 2023 07:14:33 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B281 0
0 100ms
100ms Fetch
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CNDbt90AfY4TJCqSQ-ga8spj4C62k3P5rofvUt5gQ_8ntm7wwEAEgta-gJ2D9gpGE6BGgAY-b3sYoyAEBqAMBqgSVAk_Q2wgN1JWdxDrtUnH_M7_pvp-2AfjFZ7M5gbLqtI2QQI6_bUqht5_ezlpuaAfRA_10QSE52OH8nW0nrG3kt9muRoYYk89iJOKzPQmR2jGFL1QJ2Q3OKA5udJVNqwF9q9_phgxWf9i7Qhsg7CepIoTQTDqCRb8ptXr-4ZouwYPezpvCETCqm-X03YeWWGnnq2PQ9Ugebe4ihvF_w4-ckNrnqGEsE5vkvlB2F88XZpKmQ-3ZTfDOJf-5rlop9AoChw5tK9Euj9HdsOCVg_24eKntpjl2s6kVtpaY6nmr1VbSY2v7Nxy1sACp7AksdI8jHWPP4Pp3isZhsOknH-yOyrG8pZNKmCKt-37xjniWiFRa9qEdow3ABKWG8cz-A5IFBAgEGAGSBQQIBRgEgAeP066mA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEMLXAtIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMNiBQB0BUBmBYBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=Ge-j88NYaAQ&uach_m=[UACH]&template_id=5001

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 14:23:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FD40 143 B
163 B 51ms
49ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 745
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:11:26 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3702 1 KB
749 B 36ms
36ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 13215
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 10:43:36 GMT
etag: 48472445140208031
expires: Tue, 13 Sep 2022 10:43:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js Show response
pagead2.googlesyndication.com/bg/ Frame F44D 36 KB
16 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:10:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58422
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15957
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 22:10:09 GMT

GET
DATA 200
OK truncated
/ Frame B281 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9458e4a7110139117874fea223859e635e0d424c56d8bc89fc2cca4113aca2af

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame B281 28 KB
28 KB 45ms
44ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 15:49:18 GMT
x-content-type-options: nosniff
age: 254073
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Sep 2023 15:49:18 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209070101/ 149 KB
53 KB 94ms
94ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209070101/reactive_library_fy2021.js?bust=31069447

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d24212e604ad9c37a8c3f2f403bc8155fea8a2df82e15e9eb0e5a55a9fd75143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54571
x-xss-protection: 0
server: cafe
etag: 5408037101274040351
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Sep 2022 14:23:51 GMT

GET
H3 200 integrator.js Show response
adservice.google.it/adsid/ 107 B
122 B 117ms
44ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.it/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 112ms
45ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.redpacketsecurity.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 14:23:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 064B 75 KB
24 KB 446ms
445ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a3b66ba4b11d791582866a37f142c53d18eb40fb69c71fd81ef2de008b9a090

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 24791
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 586E 76 KB
24 KB 430ms
429ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53f99c06b117d5fe6c03a076cf0ca898bb03a36aaf3004bd40de783bac2879bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 24894
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F3B8 64 KB
22 KB 403ms
403ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5b8d31d7c9bfba8942e33a8a2109e0ea2b895e8d56081fe3bd87ebc692b7aaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 22319
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 182A 111 KB
42 KB 423ms
422ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

238097b6e56e527a0e0d9bb97d45c28c9cd3cb1bfae8e360ce19f49e1a540a3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 43203
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 3702 35 B
464 B 123ms
38ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizhcw-W6vDgpGTfgFuyb4&google_cver=1&google_push=AehlK4BTrSoUgeZK6ZWLzmdzZX7UJYLhigfrhD-tMe4S4wFlmAv0dFMRNiZ_fHyH0UHna_M1SGrkT1ojGAoJIwvsZBdvdVHJ9978

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3702
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAehlK4D_LZbeGxH9gjVr8h0VL89qQbDCnGnP16C4Vx6...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFCYXIxZnl2dQ&google_push=AehlK4D_LZbeGxH9gjVr8h0VL89qQbDCnGnP16C4Vx6S6kp2beTTzu9jQRTziaERA7-csJxXtQ8TtSoh143mFwu7I11hlpTEDsYn

170 B
188 B

113ms
50ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFCYXIxZnl2dQ&google_push=AehlK4D_LZbeGxH9gjVr8h0VL89qQbDCnGnP16C4Vx6S6kp2beTTzu9jQRTziaERA7-csJxXtQ8TtSoh143mFwu7I11hlpTEDsYn

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFCYXIxZnl2dQ&google_push=AehlK4D_LZbeGxH9gjVr8h0VL89qQbDCnGnP16C4Vx6S6kp2beTTzu9jQRTziaERA7-csJxXtQ8TtSoh143mFwu7I11hlpTEDsYn
Date: Mon, 12 Sep 2022 14:23:52 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 3702 43 B
350 B 110ms
51ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFGHPnHWtGl1fAbyP7Mtw9k&google_cver=1&google_push=AehlK4CwZGRlaCvJGmakBdMKewbgJpnH73V-LML7ii88XAxqNo4b44aybLnRwhzT4z5S7mcweQNWgWRrcTzn-6aaxdfJKR8MDGgE
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:51 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: gmiu220s6gims7djkc0o0di0g28q5odv

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 3702 0
166 B 129ms
42ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEK4e9GgwL1fc0yOrOgLmV0A&google_cver=1&google_push=AehlK4BMpPYnOQ3ACKZN-CstB3jPeGKVAFBsUk7FscMb6C6avj0o94eLUNZG7EHDC7hkWU0ebcDRUmei7O9_nFyegjv6rUkQs0wi
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=4131350476&adf=484352048&pi=t.aa~a.1043414356~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=0&format=1200x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992630753&bpp=2&bdt=915&idt=373&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=2&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=crKq5Hnwvn&p=https%3A//www.redpacketsecurity.com&dtd=377
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3702
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4Bwu33ygNaNLZJOsXPQ5_YKIm3bL4GpsCRjcYDoL6vSwLELjBLMj-yIM1EsW99LkbEx7YH...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKN1UtMjMtNzVZOQ==&google_push=AehlK4Bwu33ygNaNLZJOsXPQ5_YKIm3bL4GpsCRjcYDoL6vSwLELjBLMj-yIM1EsW99LkbEx7YH7IRs0UTmWKP62OYuvFCYiU20

170 B
188 B

141ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKN1UtMjMtNzVZOQ==&google_push=AehlK4Bwu33ygNaNLZJOsXPQ5_YKIm3bL4GpsCRjcYDoL6vSwLELjBLMj-yIM1EsW99LkbEx7YH7IRs0UTmWKP62OYuvFCYiU20

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKN1UtMjMtNzVZOQ==&google_push=AehlK4Bwu33ygNaNLZJOsXPQ5_YKIm3bL4GpsCRjcYDoL6vSwLELjBLMj-yIM1EsW99LkbEx7YH7IRs0UTmWKP62OYuvFCYiU20
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3702
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_push=Ae...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4AQ4ZQKjkWFOkQzXCV220AMERQI1lPeu...

170 B
188 B

48ms
47ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4AQ4ZQKjkWFOkQzXCV220AMERQI1lPeuMZ63MS0NxX1AzsquPVYR0YMv9etYwjVDmnKpvslsjW0fDWMw_3dDQYimPgoJ5in

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1znCKTS5eG5j%2FJ4abGPrHvPYXp1ugCTyd1IHjSWSCG3vRWTtclJtzePUIeBUewHV4piJ5d7rC8tikuRfGGOP4GTfTdnXIKr4HN0VXZ8dVqfmw%2F5JdrMBn9SZRhffsop5iuaLDF6kPhQZaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4AQ4ZQKjkWFOkQzXCV220AMERQI1lPeuMZ63MS0NxX1AzsquPVYR0YMv9etYwjVDmnKpvslsjW0fDWMw_3dDQYimPgoJ5in
cache-control: no-cache
cf-ray: 74994daecd2f59d7-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET googleredir
googlecm.hit.gemius.pl/ Frame 3702 0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 3702 0
232 B 147ms
51ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KnCxfijJqiMHodQ_TcR3aDRF-MaouPkdc3ZS5CdnDbNoT6vEssIy6QBsDvwS-_flx3-mJK2w

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/ Frame 1A9B 10 KB
4 KB 50ms
50ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 60810
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 21:30:21 GMT
etag: 8616628553774171045
expires: Sun, 25 Sep 2022 21:30:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/ Frame FD07 10 KB
4 KB 49ms
49ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.redpacketsecurity.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 60810
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 11 Sep 2022 21:30:21 GMT
etag: 8616628553774171045
expires: Sun, 25 Sep 2022 21:30:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FD40
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

52ms
48ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
expires: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css2
fonts.googleapis.com/ Frame 1A9B 4 KB
636 B 53ms
53ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 13:08:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1A9B 205 B
229 B 37ms
37ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:07:18 GMT
x-content-type-options: nosniff
age: 994
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 12 Sep 2023 14:07:18 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1A9B 604 B
628 B 38ms
38ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 13:47:57 GMT
x-content-type-options: nosniff
age: 2155
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 12 Sep 2023 13:47:57 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/ Frame 1A9B 19 KB
8 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec9ae04448369cfd061688be0e2203a5696e42a15d1c179e7ba7849acb2c63cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:04:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8353
x-xss-protection: 0
server: cafe
etag: 17005385338368023289
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:04:23 GMT

GET
H3 200 d9c3feb5dbeb38b81847ec1386e6162f.js Show response
www.gstatic.com/mysidia/ Frame FD07 10 KB
4 KB 44ms
40ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d9c3feb5dbeb38b81847ec1386e6162f.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5cd3351a343011cbc0046d12c2b8bc8d7a968a09009ddb117fb1dc49fd1333

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4500
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H3 200 7035eec4e470f54a305d2f6275354b5f.js Show response
www.gstatic.com/mysidia/ Frame FD07 10 KB
4 KB 42ms
39ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7035eec4e470f54a305d2f6275354b5f.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4fa2768879ae058b28e26435993114f2a868aa56a2ff051332a1beb6a409dce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4418
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame FD07 8 KB
893 B 52ms
49ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 12:40:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame FD07 2 KB
902 B 45ms
42ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:19:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:19:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame FD07 23 KB
9 KB 45ms
42ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9632
x-xss-protection: 0
server: cafe
etag: 15013890920676311251
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame FD07 3 KB
1 KB 54ms
51ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FD07 141 KB
44 KB 167ms
86ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame FD07 17 KB
7 KB 47ms
45ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:23:30 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FD07 0
0 46ms
43ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRZI3GyfneI4KPD13oLkGn4o6hWJrfN4ihVIhuiGa65zR2cMnR4Se9c2rl6FDs2gIOu3YkyWiVPZgq1uBHi9tFfMWJZGA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 8e474446b56ed6ef0feeec2d987f1a60.js Show response
www.gstatic.com/mysidia/ Frame FD07 33 KB
13 KB 36ms
34ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8e474446b56ed6ef0feeec2d987f1a60.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84c1026e0a4c60ec0ee85c8b41c1904144aa63184260c95840924b42bd32d33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100155
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13628
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:37 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F44D 0
10 B 45ms
44ms Image
text/plain 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?qxkdwA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 css
fonts.googleapis.com/ Frame D423 8 KB
893 B 46ms
45ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 12:56:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame D423 2 KB
902 B 38ms
36ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:19:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:19:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame D423 23 KB
9 KB 39ms
37ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9632
x-xss-protection: 0
server: cafe
etag: 15013890920676311251
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame D423 3 KB
1 KB 62ms
60ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D423 141 KB
44 KB 113ms
107ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame D423 17 KB
7 KB 48ms
46ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:23:30 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D423 0
0 62ms
60ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQaUxWEGBDDwc_YWiqMUV0IA0yjjmg811UvyYyF8jkQ1d8PUBRmpWw-49A43I-NafQEEslA-0Lgb8u-YlljLhu2b_PdAA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 8e474446b56ed6ef0feeec2d987f1a60.js Show response
www.gstatic.com/mysidia/ Frame D423 33 KB
13 KB 60ms
58ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8e474446b56ed6ef0feeec2d987f1a60.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84c1026e0a4c60ec0ee85c8b41c1904144aa63184260c95840924b42bd32d33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100155
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13628
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:37 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame FD07 0
0 130ms
129ms Fetch
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C8Yan90AfY9GOCuznx_APqNykiAnA0MybavCaqZbiD6Tn8u2VAhABILWvoCdg_YKRhOgRoAGq-fSbA8gBAagDAcgDwwSqBJQCT9DzEqOlUISIfcbBMXXJThx_QP2ssA_Jz9wAjuuqprB07f9AkNIuUvduXpX1qzmr5Hgq1wSYKZOXZX0ZvCJk8dveh-XU9rTogIGMD6cciOWwQ8ZBmvRoruUxbRwCB8PR0eV2MQxPZfBTxX0juGvBp-9HBGR2aNkyes6O6DA3cybGjx3yWz0IsnuqfhIytul3-LNZSUp0Kp9fDzom3gmO0C6Cme-Qy2NrO7bGdmD4NZlpGgct5RLNoBmNM078nFeFF0WYLNLA-s8crI0ytc9Tr8Jvu50NSqlXmV7dtoz238DqhC6letihg0cbkGV6SwycSQK_57PJWJZR7ChP-oQW9NVmLOa9uhfPeKlOxLXLdoq9QBYswAT7hpz56QOSBQQIBBgBkgUECAUYBKAGUYAHvoaLZKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEOO_ENIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMNiBQE0BUBmBYBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=6kn4v0BIliw&uach_m=[UACH]

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BB39 143 B
163 B 78ms
72ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:11:26 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7AE9 1 KB
749 B 49ms
44ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 13216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 10:43:36 GMT
etag: 48472445140208031
expires: Tue, 13 Sep 2022 10:43:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8DEB 143 B
163 B 64ms
60ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:11:26 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3681 1 KB
749 B 44ms
38ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 13216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 10:43:36 GMT
etag: 48472445140208031
expires: Tue, 13 Sep 2022 10:43:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame FD07 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8c5c420bf74b4876ce199eddfe6f26cb10118ad6bc930e343cc4d438b18651ce

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame F3B8 8 KB
893 B 69ms
69ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 13:04:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame F3B8 2 KB
902 B 65ms
63ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:19:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:19:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame F3B8 23 KB
9 KB 65ms
63ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9632
x-xss-protection: 0
server: cafe
etag: 15013890920676311251
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame F3B8 3 KB
1 KB 74ms
73ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F3B8 141 KB
44 KB 72ms
70ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame F3B8 17 KB
7 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:23:30 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame F3B8 0
0 52ms
52ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQCqIRAgUq2eyIe2VR68ogSWdzinrfiLRuAzptMuUBU7qp1F6DhH_rUM5xOL0pvq8I_WAmP5rpsN_4GvxLxjWVxcBEMLQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 8e474446b56ed6ef0feeec2d987f1a60.js Show response
www.gstatic.com/mysidia/ Frame F3B8 33 KB
13 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8e474446b56ed6ef0feeec2d987f1a60.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84c1026e0a4c60ec0ee85c8b41c1904144aa63184260c95840924b42bd32d33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100155
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13628
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:37 GMT

GET
H3 200 d9c3feb5dbeb38b81847ec1386e6162f.js Show response
www.gstatic.com/mysidia/ Frame 064B 10 KB
4 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d9c3feb5dbeb38b81847ec1386e6162f.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5cd3351a343011cbc0046d12c2b8bc8d7a968a09009ddb117fb1dc49fd1333

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4500
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H3 200 7035eec4e470f54a305d2f6275354b5f.js Show response
www.gstatic.com/mysidia/ Frame 064B 10 KB
4 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7035eec4e470f54a305d2f6275354b5f.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4fa2768879ae058b28e26435993114f2a868aa56a2ff051332a1beb6a409dce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4418
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 064B 8 KB
893 B 63ms
62ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 12:59:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 064B 2 KB
902 B 45ms
43ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:19:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:19:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 064B 23 KB
9 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9632
x-xss-protection: 0
server: cafe
etag: 15013890920676311251
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 064B 3 KB
1 KB 46ms
44ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 064B 141 KB
44 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 064B 17 KB
7 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:23:30 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 064B 0
0 68ms
67ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTdMGOO_jkOYXkdtCAiEqmW-Zop_aeUSPNYObiynSUcct_hMB2_2nUCmHbs2qckMCONAi7Z6tRpbcoAKSfbVwl95syIkg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 8e474446b56ed6ef0feeec2d987f1a60.js Show response
www.gstatic.com/mysidia/ Frame 064B 33 KB
13 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8e474446b56ed6ef0feeec2d987f1a60.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84c1026e0a4c60ec0ee85c8b41c1904144aa63184260c95840924b42bd32d33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100155
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13628
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:37 GMT

GET
H3 200 d9c3feb5dbeb38b81847ec1386e6162f.js Show response
www.gstatic.com/mysidia/ Frame 586E 10 KB
4 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d9c3feb5dbeb38b81847ec1386e6162f.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5cd3351a343011cbc0046d12c2b8bc8d7a968a09009ddb117fb1dc49fd1333

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4500
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H3 200 7035eec4e470f54a305d2f6275354b5f.js Show response
www.gstatic.com/mysidia/ Frame 586E 10 KB
4 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7035eec4e470f54a305d2f6275354b5f.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4fa2768879ae058b28e26435993114f2a868aa56a2ff051332a1beb6a409dce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4418
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 586E 8 KB
893 B 67ms
66ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 13:17:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 586E 2 KB
902 B 49ms
48ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:19:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:19:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 586E 23 KB
9 KB 60ms
58ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9632
x-xss-protection: 0
server: cafe
etag: 15013890920676311251
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 586E 3 KB
1 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 586E 141 KB
44 KB 76ms
76ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 586E 17 KB
7 KB 64ms
63ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:23:30 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 586E 0
0 71ms
70ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQA36-DDG0nWHg7gdsiwT9alaH8CD_tOdjidOEpKVbYVnA-ZCgCiZKLYkXkS_4N_wXjy0ezvfukoVOwcxQOT1Qn9zDJ8Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 8e474446b56ed6ef0feeec2d987f1a60.js Show response
www.gstatic.com/mysidia/ Frame 586E 33 KB
13 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8e474446b56ed6ef0feeec2d987f1a60.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84c1026e0a4c60ec0ee85c8b41c1904144aa63184260c95840924b42bd32d33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 10:34:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100155
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13628
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 04:49:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 10 Dec 2022 10:34:37 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 182A 6 KB
672 B 56ms
56ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=en

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 14:11:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 182A 6 KB
672 B 57ms
56ms Stylesheet
text/css 2a00:1450:400e:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500&text=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:800::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Sep 2022 13:13:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 12 Sep 2022 14:23:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 182A 34 KB
14 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/m_js_controller_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8c5def060c0f2874b37ae3a7f0977c60544572e495b0ce66626305fc46755d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 12:46:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14093
x-xss-protection: 0
server: cafe
etag: 1079344988114215461
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 12:46:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/ Frame 182A 23 KB
9 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9632
x-xss-protection: 0
server: cafe
etag: 15013890920676311251
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:55 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 182A 3 KB
1 KB 47ms
45ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:18:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:18:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 182A 141 KB
44 KB 83ms
82ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44740
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1662550240112033"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 12 Sep 2022 14:23:52 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/ Frame 182A 17 KB
7 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7592
x-xss-protection: 0
server: cafe
etag: 7248493764890666469
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 26 Sep 2022 14:23:30 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 182A 0
0 77ms
62ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSQEmTq_lnsdJitZYK3kwxHbU6pGPcTkD_7erwoJnpc0BMCyUM0JdjsSnrXV586jwaXLE8tuKOW2sliZ0h344MMXnX2fw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame F3B8 0
0 89ms
89ms Fetch
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CqyNZ90AfY7y0OYmmYfiKoqgNraTc_muh-9S3mBD_ye2bvDAQASC1r6AnYP2CkYToEaABj5vexijIAQGoAwGqBJQCT9Aq4hn5qsoOtCp8ang0iw9gG1tWF0N62Lj7peKPukITzjSRSXjNmm9g0W6QI-OCTPfGdSwH6Z2ncvED31a8duZyQlFbOd-JEIDT4eE6xS09eQv30XqE0KKl_yqBxGRxXyu9pyyga6b7Eb4oubxALHnf8XH01kuYJ1TjTdQJWLjAd7VWt6NWdaEmkpPkm1qydJaAHv7Rk3CftvjwPlhIUYOOVBd8Tt5WACW450mBSAPFafD3fXZaAzPtLew5wVLVd43tNIZdNFIKznSi6ByUatFlo9qaiVFuj-bCFxSSAzO07gg3ezUdsufczr66eDAKnVhfYMFTsy9F3VoCxOUxjTUuiU4xUyzGCrFH-DPN8twfDlCQwASlhvHM_gOSBQQIBBgBkgUECAUYBIAHj9OupgOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBD1sQHSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTDYgUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xNTM2MzM0MjE5NTYyNzcxGAA&sigh=4wsUG6Z6zqU&uach_m=[UACH]&template_id=5007

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/15843352396057966369/ Frame F3B8 4 KB
4 KB 70ms
70ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15843352396057966369/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47d18ece2a7fe68cf7ed4fd9ee99e80d73d5e7662fedbddbb9d9de459ed2299

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sat, 10 Sep 2022 07:16:50 GMT
x-content-type-options: nosniff
age: 198422
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3838
x-xss-protection: 0
last-modified: Thu, 12 May 2022 10:13:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 10 Sep 2023 07:16:50 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/11325930680005311225/ Frame F3B8 3 KB
3 KB 66ms
66ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11325930680005311225/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bc49569048b009b78cf88826f421495bafb16335cb08a68e8fcf9ece6954ad9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 07:14:33 GMT
x-content-type-options: nosniff
age: 544159
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3348
x-xss-protection: 0
last-modified: Fri, 13 May 2022 12:28:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 06 Sep 2023 07:14:33 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 7AE9 35 B
210 B 46ms
36ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizhcw-W6vDgpGTfgFuyb4&google_cver=1&google_push=AehlK4ACvcOgT0gHf9t7lQZ9-kGc3WDLPvXtTBnsIsPuVTn9-bdSZagFnaE1565sTY94S6mFfkxHBGLBxlsbSTyG5EWNU2piz1g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7AE9
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4Bu9bk7...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4Bu9bk7...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4Bu9bk7qD2gTUP-3DDZpDbfpnRUoOiPQqToeYrHJwR_qmlgULjNwUMfl-NgFWDxih...

170 B
188 B

50ms
50ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4Bu9bk7qD2gTUP-3DDZpDbfpnRUoOiPQqToeYrHJwR_qmlgULjNwUMfl-NgFWDxihv2XbWw6FbVxoK0TUw62iCdX0fHESw

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4Bu9bk7qD2gTUP-3DDZpDbfpnRUoOiPQqToeYrHJwR_qmlgULjNwUMfl-NgFWDxihv2XbWw6FbVxoK0TUw62iCdX0fHESw
pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 12 Sep 2022 14:23:53 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 7AE9 43 B
64 B 76ms
45ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFGHPnHWtGl1fAbyP7Mtw9k&google_cver=1&google_push=AehlK4BG-qN0zV5icbyjFTHfZvkKiAxKWuCg78puPuSbVIatMRXGDHvgk-ZyyFxrHe3WF41bRHkfjHXtgPv7y72m5XgUPB1Lpg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: tdcptoiuc1ghaifbu0r5gkhhs3kmem9i

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 7AE9 0
41 B 47ms
38ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEK4e9GgwL1fc0yOrOgLmV0A&google_cver=1&google_push=AehlK4BC0L0iMpECMcDmwQ5oW8sFOOVcOHq9xMTQJpGJPyYrPO5q8C57sJCbnyQo6Vhy1njW-91vGQI6Pznihk1y8LCsXP0ByA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7AE9
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4D0WtN7xYfeTJ4uYZhESJljsQY5iH9ZGKmzIxHZqxX_FzQnEZu9I_agRYdE5brQmlYnzqb...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKSjctUC1DWUwz&google_push=AehlK4D0WtN7xYfeTJ4uYZhESJljsQY5iH9ZGKmzIxHZqxX_FzQnEZu9I_agRYdE5brQmlYnzqbOGEgFPKWxCuOaVhSjs6RPPmQ

170 B
188 B

51ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKSjctUC1DWUwz&google_push=AehlK4D0WtN7xYfeTJ4uYZhESJljsQY5iH9ZGKmzIxHZqxX_FzQnEZu9I_agRYdE5brQmlYnzqbOGEgFPKWxCuOaVhSjs6RPPmQ

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKSjctUC1DWUwz&google_push=AehlK4D0WtN7xYfeTJ4uYZhESJljsQY5iH9ZGKmzIxHZqxX_FzQnEZu9I_agRYdE5brQmlYnzqbOGEgFPKWxCuOaVhSjs6RPPmQ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7AE9
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Crx5ZOBngIuLNH0uil7Z73DOfQz_VYH...

170 B
188 B

51ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Crx5ZOBngIuLNH0uil7Z73DOfQz_VYHSviSYUHIjGEufQgiw-d8MnCjcFSICQ0yJxU_MSwCtEKBz52x3A5PGO9ye0JpTk

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EGH%2FbFieccKgWlDM1mFRMjxfM7mtm72B2SN0r7xd7zu1DwTiHYqfZJ0Rtd5REZaVowlhfHsXVkMPLmpRBggoXVAw7kV6lu1a%2FTttk1pzrMLTIcxa4hHPQgTUnYX3aik0fgqUqTFafHc%2FFg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Crx5ZOBngIuLNH0uil7Z73DOfQz_VYHSviSYUHIjGEufQgiw-d8MnCjcFSICQ0yJxU_MSwCtEKBz52x3A5PGO9ye0JpTk
cache-control: no-cache
cf-ray: 74994db0fa3f59d7-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET googleredir
googlecm.hit.gemius.pl/ Frame 7AE9 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7AE9 0
12 B 51ms
45ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LDWI20EO9E7QuE2ix2JZGp874-FffDdsL2pKtOCQjMJJeKRRKbIchuSIgI6wcMq5AVNwUxsw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3681
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizhcw-W6vDgpGTfgFuyb4&google_cver=1&google_push=AehlK4A7EuY1OS5B7pA-kRMCK_qlqYsaOxQTGiYcfJmg1gTyhvKRZ9nISx...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4A7EuY1OS5B7pA-kRMCK_qlqYsaOxQTGiYcfJmg1gTyhvKRZ9nISxQGNIaSzMG01c7OEhyIrUcNuQlQIAb7h9sn5TaF-q1e&google_hm=N6GZf_EUsj8L...

170 B
188 B

51ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4A7EuY1OS5B7pA-kRMCK_qlqYsaOxQTGiYcfJmg1gTyhvKRZ9nISxQGNIaSzMG01c7OEhyIrUcNuQlQIAb7h9sn5TaF-q1e&google_hm=N6GZf_EUsj8L9_sGC7hNyw

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4A7EuY1OS5B7pA-kRMCK_qlqYsaOxQTGiYcfJmg1gTyhvKRZ9nISxQGNIaSzMG01c7OEhyIrUcNuQlQIAb7h9sn5TaF-q1e&google_hm=N6GZf_EUsj8L9_sGC7hNyw
pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3681
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAehlK4DDsV5D1zxlUYSKm4IdoVlnOrlF6MeNaaWBSPx...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFBRUtyeFVKUA&google_push=AehlK4DDsV5D1zxlUYSKm4IdoVlnOrlF6MeNaaWBSPxhmmME6qEdVlBZKt_VJDu7C8WWcm9eMy4A7lN0glHErn4o_vV53VcZI7Ni

170 B
188 B

58ms
56ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFBRUtyeFVKUA&google_push=AehlK4DDsV5D1zxlUYSKm4IdoVlnOrlF6MeNaaWBSPxhmmME6qEdVlBZKt_VJDu7C8WWcm9eMy4A7lN0glHErn4o_vV53VcZI7Ni

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WXg5QUBBQUFBRUtyeFVKUA&google_push=AehlK4DDsV5D1zxlUYSKm4IdoVlnOrlF6MeNaaWBSPxhmmME6qEdVlBZKt_VJDu7C8WWcm9eMy4A7lN0glHErn4o_vV53VcZI7Ni
Date: Mon, 12 Sep 2022 14:23:52 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 3681 43 B
356 B 102ms
43ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEESkjziewjIxHwfCsXTx0Js&google_push=AehlK4B1dl_5E8PTBHldl7rCbF9smElQqSMnUwpnLVazOYUgCwBqVRjNaaGEnt6mHyZ7Eexa1HKcfwnf-icJjPtB147mCABA0DQ1&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 3681 43 B
64 B 53ms
44ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFGHPnHWtGl1fAbyP7Mtw9k&google_cver=1&google_push=AehlK4C2c7AwnzG-FeJzg0lxsgbwT4H50E2FLZRvdtsIZqiLlFmysfcCuKunaktiF9KxFM3FO_84eTinV5AkjWGQy6pZSxg07ccg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: t8bejh9df7f2nfagl55uldmppq49m1hm

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 3681 0
41 B 46ms
39ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEK4e9GgwL1fc0yOrOgLmV0A&google_cver=1&google_push=AehlK4Dd1vEbbISn5Qjd1lmDkr_ikWnZJ5Vf86nDGsJ4tjAIuNBXuuMhD9IqGXxklSXBGXYiuvAniXIjxPr0WUl-H-DV-IPk8-bN
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3681
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4CA7dmnU5i33dKmUrt0BLHf7e_zBktS2Dad1yd0OyzbdGkaSOJXgbd9f8HbAjBAjg0v6eF...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKTFotSy1LMklH&google_push=AehlK4CA7dmnU5i33dKmUrt0BLHf7e_zBktS2Dad1yd0OyzbdGkaSOJXgbd9f8HbAjBAjg0v6eF0B1SKQNT4luKIJSaXZS_Xtvuj

170 B
188 B

70ms
55ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKTFotSy1LMklH&google_push=AehlK4CA7dmnU5i33dKmUrt0BLHf7e_zBktS2Dad1yd0OyzbdGkaSOJXgbd9f8HbAjBAjg0v6eF0B1SKQNT4luKIJSaXZS_Xtvuj

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZKTFotSy1LMklH&google_push=AehlK4CA7dmnU5i33dKmUrt0BLHf7e_zBktS2Dad1yd0OyzbdGkaSOJXgbd9f8HbAjBAjg0v6eF0B1SKQNT4luKIJSaXZS_Xtvuj
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3681
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Bu7lB9m4onzqjfc586UDMFOfox3cyzw...

170 B
188 B

70ms
54ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Bu7lB9m4onzqjfc586UDMFOfox3cyzwg2Sp6uTsgaxbXczj3ICI1jo_9XmMjgQL5v64_20YiT13AylTEgI-OrES8BEuqQ

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gYG5FepmXJADL8J2LdIpM910gKXeVaHOoz4N5EuAz0I4UJqRyus6xhISeAvF1SHQUK3kvI4EFLHZeAzvkZxQ9EVEo2PuBmqdKYWhCdGSQg3UBn3gj5y%2FzIASS65C96%2FWpkDyEpTuHzYkEg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4Bu7lB9m4onzqjfc586UDMFOfox3cyzwg2Sp6uTsgaxbXczj3ICI1jo_9XmMjgQL5v64_20YiT13AylTEgI-OrES8BEuqQ
cache-control: no-cache
cf-ray: 74994db11a8a59d7-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3681 0
12 B 55ms
49ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jvm9sb9ZPPJ1ULobMWhyYoYmZfauv-R2kn7orXmHpyXx7FcBX9c5B-JIq_Uygwrdi3-Zhb

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BB39
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

83ms
75ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
expires: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js Show response
pagead2.googlesyndication.com/bg/ Frame 7D57 36 KB
16 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:10:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58423
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15957
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 22:10:09 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/11325930680005311225/ Frame 064B 3 KB
3 KB 44ms
44ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11325930680005311225/downsize_200k_v1?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bc49569048b009b78cf88826f421495bafb16335cb08a68e8fcf9ece6954ad9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 07:14:33 GMT
x-content-type-options: nosniff
age: 544159
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3348
x-xss-protection: 0
last-modified: Fri, 13 May 2022 12:28:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 06 Sep 2023 07:14:33 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 064B 0
0 85ms
84ms Fetch
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CvURD90AfY-PPN4i9YJvyrcAJraTc_muh-9S3mBD_ye2bvDAQASC1r6AnYP2CkYToEaABj5vexijIAQGoAwGqBJQCT9CBB7dD8aur3XFcNLosfPtuce26bcbirvrOH7Vv1OJFlfrgq3Bls5vywX5esFTHjVdjD3F_IxSDPOmATI3Xk6-XYtyKr8CFXhDR8_wH0hhjxJOb3lC4Tp02voyIZ3je73E_ZUdo2QHFjPALVQNn8OGRrQH5SuMVX75ZxncreVKlAljA9CCs__Pivdc7GpIV4x_kmIRKpjxnrSj9NSBCzE8meEXLx8J9E46vohr3Zug1nehL8FkAbmdAElo2IZ_SphjAlOUeI-3GntyAU3hOoIBi7e8GYRTM2MC_-a-uaLFFQzBIhjXTR9P-D3w3HtztyuLJOWE9v64b0_6Fg5mgUuZscpn12KdBIH13JArxlox-5uG5wASlhvHM_gOSBQQIBBgBkgUECAUYBIAHj9OupgOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBCJlQHSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTDYgUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xNTM2MzM0MjE5NTYyNzcxGAA&sigh=LqHaeVitK40&uach_m=[UACH]&template_id=5001

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8DEB
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

85ms
70ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
expires: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:52 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js Show response
pagead2.googlesyndication.com/bg/ Frame 93F4 36 KB
16 KB 63ms
60ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js

Requested by

Host: t.co
URL: https://t.co/3tt2kxWiPY

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:10:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58423
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15957
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 22:10:09 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 815B 143 B
163 B 47ms
38ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:11:26 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A5A0 1 KB
749 B 58ms
53ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 13216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 10:43:36 GMT
etag: 48472445140208031
expires: Tue, 13 Sep 2022 10:43:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame F3B8 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc347f44b69a17cc59ec70c5b0997f9533efbacbe03214a8dce362eeff6c81c9

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 12D1 143 B
163 B 51ms
46ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:11:26 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 00CA 1 KB
749 B 68ms
59ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 13216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 10:43:36 GMT
etag: 48472445140208031
expires: Tue, 13 Sep 2022 10:43:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 064B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5c5baefabe2fb32542b7939f79f759f9ee99785d27b654c48683870fcd90ce7a

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame F3B8 28 KB
28 KB 55ms
54ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 15:49:18 GMT
x-content-type-options: nosniff
age: 254074
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Sep 2023 15:49:18 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/11325930680005311225/ Frame 586E 3 KB
3 KB 64ms
63ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11325930680005311225/downsize_200k_v1?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bc49569048b009b78cf88826f421495bafb16335cb08a68e8fcf9ece6954ad9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 07:14:33 GMT
x-content-type-options: nosniff
age: 544159
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3348
x-xss-protection: 0
last-modified: Fri, 13 May 2022 12:28:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 06 Sep 2023 07:14:33 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 586E 0
0 103ms
102ms Fetch
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CbMFo90AfY-TaOPvA7APZyoWoBK2k3P5rofvUt5gQ_8ntm7wwEAEgta-gJ2D9gpGE6BGgAY-b3sYoyAEBqAMBqgSUAk_QeTCHxZfr-EYj42P9obun20NgUtm8lTf7HZTyTyb0qf48bXJ6Lmia2RW-6Zsp80G65eUOHvvkTkelTt2P7aBYzQ5jzmQi5b4mh_W0CneqENMVuHXMnWJ7QNTrBnt9KHNrLRp7DZsThhXfG8oBlNF75sToaTZN9sGLtLO_hztIDpvzsiiUDIQwb43TNkhRoLk8ehwwZpKTlfFNza-CR9ehdyDG_vmWx4mP0P7l9vMkCczqkxxiZffmfAvydW9Opjq9ndXgW01q2Ncb7Ic0IGYXIYCXuBmkBuR6L-rSo0-eSLYlUCAdgaaxndwopSgQEsuRMkTKVO80TxuUj4fdOvM3Li_qDh6qHtA8fSWaM2qGz8oAB8AEpYbxzP4DkgUECAQYAZIFBAgFGASAB4_TrqYDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQ9aEB0ggRCIDhgBAQARgfMgKqAjoCgECACgHICwHYEw2IFAHQFQGYFgGAFwGyFxwKGggAEhRwdWItMTUzNjMzNDIxOTU2Mjc3MRgA&sigh=zhqNX1inDKU&uach_m=[UACH]&template_id=5001

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8C44 143 B
163 B 57ms
54ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:11:26 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 28A4 1 KB
749 B 49ms
48ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 13216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 10:43:36 GMT
etag: 48472445140208031
expires: Tue, 13 Sep 2022 10:43:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/2648124484931633733/ Frame 182A 93 KB
93 KB 98ms
98ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2648124484931633733/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIiwQQkgIYASABLQAAAD8wjAQ4kgJFAACAPw&rs=AOga4qlzs0FPyZPxHnvGCmI5niW-44fVYg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22fdb7dc8a0b227d7bd1026090cd0105f12bfcc6966b33402653ca496ce16265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 94868
x-xss-protection: 0
last-modified: Sun, 11 Sep 2022 13:55:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 12 Sep 2023 14:23:52 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 182A 0
0 91ms
91ms Fetch
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CnSRA90AfY87GOfC17AO89JfwC_bcn6xrq-6dnbcQwLTq248OEAEgta-gJ2D9gpGE6BGgAb-GqeYoyAEGqAMByAPLBKoEpgJP0NfNYwzKnpUaFREflxAc6lgFcgQR7CD6TUxFqefgS5wDrS_ykGBwWGH4e9cuXDe8JedxvnhqIvLinQAgJtV84c1wxneXjfIjywUXct7ti429FSieHTHWMWh-pFk0zSnTeebWPETq6XkZnaGcyMNKyHNe9NVVfv1vwEssysHuIGdpJr6v-pIdBJTdiUiQ1y3YniT6NIiSt_aTfJOkWKHzXxwKW2Emer1qw2li8dypwReK6SZH0-YXWOakaP6OB87hqmfww52D972mgqB8KQ-8BAuVqydbRrIkiWVoOMdIP_zrmvXqe_56noRRF6Kx5Bd853ABofNXg26Brz63KY02mAJ9_Z_AFdhe6eW8LYAjeXiycgXMjxIp9kKLejU_FCs2gLeYZZfABLmi3Mv-A5IFBAgEGAGSBQQIBRgEoAY3gAe_vvnFA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEP6bUtIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTE1MzYzMzQyMTk1NjI3NzEYAA&sigh=FuxJ7L0sFuE&uach_m=[UACH]&template_id=492

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DC69 143 B
163 B 47ms
46ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 12 Sep 2022 14:11:26 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B70D 1 KB
749 B 41ms
40ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

age: 13216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 10:43:36 GMT
etag: 48472445140208031
expires: Tue, 13 Sep 2022 10:43:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 586E 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c4def69ddb2d0d015b7d3361a2074cc9235280d520c2c419f2eab67fa5ec3bc3

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 182A 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eac0322beff650b42ae088317d82c6bf6cfeac6c2bd3071bdf126827b2eb81d0

Request headers

accept-language: it-IT,it;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 182A 16 KB
16 KB 52ms
52ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 12:56:05 GMT
x-content-type-options: nosniff
age: 5267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Sep 2023 12:56:05 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 064B 28 KB
28 KB 37ms
36ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 15:49:18 GMT
x-content-type-options: nosniff
age: 254075
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Sep 2023 15:49:18 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 586E 28 KB
28 KB 52ms
52ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 15:49:18 GMT
x-content-type-options: nosniff
age: 254075
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Sep 2023 15:49:18 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 72ms
72ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220907&jk=261561337798831&bg=!t7SltPDNAAZTikH4c4o7ACkAdvg8Wu0_jRSxa7sWHj-EGdBIFFb_D-XWW3ziXLdyopHgx0-iQhpn4wIAAAFSUgAAAANoAQeZAuxT3Ubz0oh8TFcV_giVEwJ2hZEm-v8JYVmtEfoeU1tBvq-dacYWi3M7ubt4Ox37AjOgZjhng9SgmcHgBqdPTMB2fAfd4l81zrSYZp_EcSL5RP0Bd3NjLX8p2jVuM5zEWxTJjNRIitv7y6iBS_VnBwQtGKijEv5_a1--poqjX1H1RF3Hcyop87PJpb2ZPOOxUJmngI-laznMH5QzIm63pjr_1u40XDLYConscnfaAM05y6ZWYqHx8AD6i5rqJTMN3nyrtAHCEGR8RCkdItVrmP-JdcL2VkjSihgX1F4r8NT9DBv1e7jJ0zMKK-QkO1rq5SHbWxvhAlFAVIZT1RUaRhiV4AT_v9oHtAMwrCtZFojoTHRZtecWyTCHjUbWghZezVcsh5DFb_j65YAVVdtr_CaHLOGiAVNWCk9LOIWY_KbiBkijT6xEo2Vlmryy-rihodlaLF7VvRyPbLw6wyQhvGumKX_egPQPT79O0-_WglLB3VMijuyW4zqy0Cj5ZaTp7IMOc1zgaZsfUxB6Sz4zAT-eLraCnstrn4smK1TZx0h2DWl4ZPaYmv-7zjvdOHfAPe6iHYJjKUM7Bwl31QtbELwjX1qMIYxKClHdprwFCoU13whOsExZMIO4-lurneL3EPGKPn5byqncjki5_86qsJPSGC0aP4Zy9zVscUSnM5X1WgsZNizQb7nbj8c0Yo8_0Bl76ZlK_jZwdZYF94W_Xz0FX3bQ0HzOF1d1BgngQPhtaRN0vcO7hfRhVP3Awj6MFt5gp0JoqVvcBU-jHx3_lQDhQhyju5NVILXocrqKbIunFQC33gY3L1GL990GcLp9PVBRfcAa_tQj9-BqJ_CDE26bau3fXq4zXZSvRIsdUQMq5cvC65ytB2tUAdO_k3QrKq_FoEgQmwylCa1gfW19Um-Cq-6CSHg5aVo3kaGyD4SkufBMvPCXyV4UzrkQuMEuiuSQIIJTdx8Fid7AFbrKM3AyTngtY-hlYaUTPFIf
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://www.redpacketsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H2 200 dpixel
cms.quantserve.com/ Frame A5A0 35 B
210 B 39ms
35ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizhcw-W6vDgpGTfgFuyb4&google_cver=1&google_push=AehlK4CMv904a4AfP43bW07imHMn1AeQscB1MBFfPTzbw0U6r23vPXtQQ5sZe-FoThERIuMx-ZEtBEYiC3tQRJdTl4ktyobLOA

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5A0
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEGuMZrlXnD2nOdDkRqRsPoo&google_cver=1&google_push=AehlK4Dt_X9_-uJhr9_N-ZPYuZNWnFfVSIwE2pTxmDvPRhRzdvQO_VIZriSwGVEvJWid4pGbginUVucYodNxbcYkhoHF16Y2Xow
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4Dt_X9_-uJhr9_N-ZPYuZNWnFfVSIwE2pTxmDvPRhRzdvQO_VIZriSwGVEvJWid4pGbginUVucYodNxbcYkhoHF16Y2Xow&google_hm=Q0FFU0VHdU1acmxYbkQybk...

170 B
188 B

50ms
47ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4Dt_X9_-uJhr9_N-ZPYuZNWnFfVSIwE2pTxmDvPRhRzdvQO_VIZriSwGVEvJWid4pGbginUVucYodNxbcYkhoHF16Y2Xow&google_hm=Q0FFU0VHdU1acmxYbkQybk9kRGtScVJzUG9v

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 14:23:53 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4Dt_X9_-uJhr9_N-ZPYuZNWnFfVSIwE2pTxmDvPRhRzdvQO_VIZriSwGVEvJWid4pGbginUVucYodNxbcYkhoHF16Y2Xow&google_hm=Q0FFU0VHdU1acmxYbkQybk9kRGtScVJzUG9v
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5A0
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4C_JuLU...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4C_JuLUtIBoVt6ezAsubAYA9Bw49GzrlNj1yxfYiMAyu7QsvHg_lk0m8I8wtB4YTu...

170 B
188 B

47ms
46ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4C_JuLUtIBoVt6ezAsubAYA9Bw49GzrlNj1yxfYiMAyu7QsvHg_lk0m8I8wtB4YTuwlmuOLuTrnhfh-JQChXxNTdfnoig

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4C_JuLUtIBoVt6ezAsubAYA9Bw49GzrlNj1yxfYiMAyu7QsvHg_lk0m8I8wtB4YTuwlmuOLuTrnhfh-JQChXxNTdfnoig
pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 12 Sep 2022 14:23:53 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame A5A0 43 B
64 B 44ms
43ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFGHPnHWtGl1fAbyP7Mtw9k&google_cver=1&google_push=AehlK4CPpvuIZ128vRrh2KY9fOcqtxGUbhAOY7x8wTFTZf3hWpPHxAO8q2RfEKiEOeZQ4vgz4yurUNALAKpHHrLn-gcVlurP8j8
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: t7ipls4a57qqrmrt262a4vc19257em5k

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame A5A0 0
41 B 41ms
40ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEK4e9GgwL1fc0yOrOgLmV0A&google_cver=1&google_push=AehlK4AzoHqVNi6GuZPtu2oTBnxQATOapTxMR2qSjVmgHr_L-xwjAB9z0Z6fNUOxVcKhs5J7loI8n8VZoJkFHZOGaNSjJpxua8c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=3455214692&pi=t.aa~a.868799282~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280&nras=5&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=3111&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=HLq4kxcqWr&p=https%3A//www.redpacketsecurity.com&dtd=48
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5A0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4CYzfrGJvVR_jCQwOKXENYM_c_ZAW4dlslRi748G2xUBuf7p5J_njS7EqvgdjEHyLAmek5...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLM0MtMTMtSUk2MQ==&google_push=AehlK4CYzfrGJvVR_jCQwOKXENYM_c_ZAW4dlslRi748G2xUBuf7p5J_njS7EqvgdjEHyLAmek549Vx5VpIWFu0EY6qi4DNZgg

170 B
188 B

47ms
46ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLM0MtMTMtSUk2MQ==&google_push=AehlK4CYzfrGJvVR_jCQwOKXENYM_c_ZAW4dlslRi748G2xUBuf7p5J_njS7EqvgdjEHyLAmek549Vx5VpIWFu0EY6qi4DNZgg

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLM0MtMTMtSUk2MQ==&google_push=AehlK4CYzfrGJvVR_jCQwOKXENYM_c_ZAW4dlslRi748G2xUBuf7p5J_njS7EqvgdjEHyLAmek549Vx5VpIWFu0EY6qi4DNZgg
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A5A0
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4C-ANHvxK4DunlzoATzByEB5hLfMKZ7G...

170 B
188 B

51ms
47ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4C-ANHvxK4DunlzoATzByEB5hLfMKZ7Gu4cx2Yyj-xp_1fzmoBHDKv0AicZJVTP5-VmmJ0p-BhROOnbgjz2BlXo6PFgrWo

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Hhi%2FVnquV2ZdKfDb9V3vbVnhAO9RetJ1OVnKF5s4S%2BoQc%2BcJ7bEhZS%2Ba2XQUTmegz0rwxEu1%2BG7w1mhTLK3L%2BLUPmeintnnd6DN9fdvqj%2BO4vTmgo5sjeVCp4mqYu%2FEVcAU0aOj%2FpE7rQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4C-ANHvxK4DunlzoATzByEB5hLfMKZ7Gu4cx2Yyj-xp_1fzmoBHDKv0AicZJVTP5-VmmJ0p-BhROOnbgjz2BlXo6PFgrWo
cache-control: no-cache
cf-ray: 74994db58cc259d7-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A5A0 0
12 B 45ms
44ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I8MRyawyZ9_afuLp-KrVV3LswJTWMNLZRZk-m1MTbc5ovy4s5xsCwEusjEoDFsJCK9V1zN

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 00CA
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEGuMZrlXnD2nOdDkRqRsPoo&google_cver=1&google_push=AehlK4BU0bctb0rR-IzzZ93EEmw3Nj1g-nl7lBhTmDBbSluTx76stS1voU3QbEJ-VoMG4wQ7k2CQ99BYxZZlAr08BcjJjkf5Bw
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4BU0bctb0rR-IzzZ93EEmw3Nj1g-nl7lBhTmDBbSluTx76stS1voU3QbEJ-VoMG4wQ7k2CQ99BYxZZlAr08BcjJjkf5Bw&google_hm=Q0FFU0VHdU1acmxYbkQybk9...

170 B
188 B

47ms
45ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4BU0bctb0rR-IzzZ93EEmw3Nj1g-nl7lBhTmDBbSluTx76stS1voU3QbEJ-VoMG4wQ7k2CQ99BYxZZlAr08BcjJjkf5Bw&google_hm=Q0FFU0VHdU1acmxYbkQybk9kRGtScVJzUG9v

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Sep 2022 14:23:53 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AehlK4BU0bctb0rR-IzzZ93EEmw3Nj1g-nl7lBhTmDBbSluTx76stS1voU3QbEJ-VoMG4wQ7k2CQ99BYxZZlAr08BcjJjkf5Bw&google_hm=Q0FFU0VHdU1acmxYbkQybk9kRGtScVJzUG9v
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 00CA
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4DgqaqC...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4DgqaqCtGwCdM108BuxaaPTf-gd1NIySpJKo2m-lzU9KVQGWicbPi3OmLQJ0HWhnK...

170 B
188 B

48ms
48ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4DgqaqCtGwCdM108BuxaaPTf-gd1NIySpJKo2m-lzU9KVQGWicbPi3OmLQJ0HWhnKzkXIrdGpi1ogP2sHSneyyRbh4BSMk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4DgqaqCtGwCdM108BuxaaPTf-gd1NIySpJKo2m-lzU9KVQGWicbPi3OmLQJ0HWhnKzkXIrdGpi1ogP2sHSneyyRbh4BSMk
pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 12 Sep 2022 14:23:53 GMT

GET
H3 200 sync
odr.mookie1.com/t/v2/ Frame 00CA 43 B
61 B 73ms
44ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEESkjziewjIxHwfCsXTx0Js&google_push=AehlK4Bkk1KuLdvRbfkvYbJ9NjAdWTEs-l9VTTvQu1FAs-1V_LTqhZLLYE_mQNt_qgFQ_HODZnvHiCrySJn-RDOTkoNCDO1rM2c&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 00CA 43 B
64 B 49ms
42ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFGHPnHWtGl1fAbyP7Mtw9k&google_cver=1&google_push=AehlK4BXGsloR0iaXImn4bnQWn_49JGA9G9XjXxSz4hVpFn2L_AcTH8XXRcnI4ykv7fEiFUTlTKTZEsSE2aL9x4PuO9FElzRhzA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: kg8evr1j4ociqr00gu9458o606hjugcc

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 00CA 0
41 B 58ms
44ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEK4e9GgwL1fc0yOrOgLmV0A&google_cver=1&google_push=AehlK4D4totPw45LcxkshB9iRL4_kf4TMOgI9wT9ioVpFOjLRKyXzMjNEqyoHsMEQOP7UX5dvedCVkUX_dGUfIxG2HGHmjUBhe8
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 00CA
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BxzBy8SSjKISL77xD7zPBXnRYVuOG9l...

170 B
188 B

66ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BxzBy8SSjKISL77xD7zPBXnRYVuOG9lCOq5VwNQ8WU6a7dQZt-L2_ZvqDyJ-ru_Nixhp-o6NCaqVayIJuM-LQ5DF5XlTU

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7D7VinSf4fmn0%2Fg%2F16tnjPzEAEjE%2BPr05q5cw1NMYh9ESzRlUrmVlMvCPcUpalvykh61Dr2Q0Wg%2BN9qYwfMp%2FqE9syMSbFmQtq60Qs6NCfTT9Y%2Fud23MBUCF2uePcLZSqEIjkpso%2FWJnug%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BxzBy8SSjKISL77xD7zPBXnRYVuOG9lCOq5VwNQ8WU6a7dQZt-L2_ZvqDyJ-ru_Nixhp-o6NCaqVayIJuM-LQ5DF5XlTU
cache-control: no-cache
cf-ray: 74994db59cec59d7-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 trk
ag.innovid.com/ Frame 00CA 43 B
296 B 290ms
47ms Image
image/gif 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEAeZLsxQawF8ucHESoM9-Aw&google_cver=1&google_push=AehlK4B6cgQmVrB3VNHNJB9m-zEQbHxflP3jXSzbKZa7NdOgW0I2ZwW3rHa_mFf2MqVcTtPO2_T18RuiiQLS2hcW6pJwOJlMN7k
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 00CA 0
12 B 51ms
46ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I5cjHshyNNDyKFxCZzXfUSesUF5kPX9OiDBMT89RwzUNC4Vb3EA9eNK_Si9PgQ86rr-2r1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 28A4 42 B
189 B 115ms
44ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAehlK4CmLBuHHFVLm9dhAELdlqe5ASPcq-uEuJzbPNrrKnY2YlpPLqT7GHHDLTOX-CnEF3houPekrb94Bn-mi4cdnAATemW-4niB&google_gid=CAESECJUZJlK72Cg-rg38DdInD8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 12 Sep 2022 14:23:53 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 28A4
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4ADXoUX...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ADXoUXDkrB6gm3l6myxRpcRz0f6isnPxJevYLCuM3S8xGXWu7RWQHt52pfRAxPYH...

170 B
188 B

50ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ADXoUXDkrB6gm3l6myxRpcRz0f6isnPxJevYLCuM3S8xGXWu7RWQHt52pfRAxPYH-6XKoMJMmDe2GxWv11SMeISDJsQA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ADXoUXDkrB6gm3l6myxRpcRz0f6isnPxJevYLCuM3S8xGXWu7RWQHt52pfRAxPYH-6XKoMJMmDe2GxWv11SMeISDJsQA
pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 12 Sep 2022 14:23:53 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 28A4 43 B
64 B 62ms
54ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFGHPnHWtGl1fAbyP7Mtw9k&google_cver=1&google_push=AehlK4CmLZVbnuqRDnnxTBkwjFZDTFuRQwZyZYdSWTfdIetdLE056WnS7bs_2pr74LHDiVJwKKo1CEOxc0J-BBR0FKGyblMF0tbW
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 3bo5pfjvhjcokc43vjt3puqtf33ram82

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 28A4 0
41 B 57ms
46ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEK4e9GgwL1fc0yOrOgLmV0A&google_cver=1&google_push=AehlK4AV-cXXdWzklR74YGMKuxwZaiXWth3NbmPBRCcxY4tuXJz9pQ4trszArWqmr2UbJimevhY99uAGjJCTdg2jjoW1_WSxWJF-
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 28A4
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4DX9k-hINxlIlm84HeebeFwkezZdECH--9rjaVFLXWxH_EoVi_Wix6EHOBVo3hWgbaHOzd...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNDMtNS1KSElP&google_push=AehlK4DX9k-hINxlIlm84HeebeFwkezZdECH--9rjaVFLXWxH_EoVi_Wix6EHOBVo3hWgbaHOzdG4VkLRYjtplknhDzoj1WuSEH2

170 B
188 B

59ms
58ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNDMtNS1KSElP&google_push=AehlK4DX9k-hINxlIlm84HeebeFwkezZdECH--9rjaVFLXWxH_EoVi_Wix6EHOBVo3hWgbaHOzdG4VkLRYjtplknhDzoj1WuSEH2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNDMtNS1KSElP&google_push=AehlK4DX9k-hINxlIlm84HeebeFwkezZdECH--9rjaVFLXWxH_EoVi_Wix6EHOBVo3hWgbaHOzdG4VkLRYjtplknhDzoj1WuSEH2
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 28A4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4A-q-N3PFUtMpUFL20uUSc11JQIyZl0w...

170 B
188 B

68ms
66ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4A-q-N3PFUtMpUFL20uUSc11JQIyZl0wBOuUEFwsDMPf60PNboIBdi1pKAwftrgzPs9uDXPkwBHtgWatt27hhY4sxkAVkk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yBHsSkh2vvIpOHlF9MacLrAjalto0YjxzP5NuIioMRbVIgXtvymoL%2Fj3D0jLMD9T3DGc1b0O0KI%2BoQjjNOcaAdloPa%2BQxiW%2BPHdmtuHPNrE8VtmSWOzt2wmWvNrg65mELsNJPUCTOVrliw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4A-q-N3PFUtMpUFL20uUSc11JQIyZl0wBOuUEFwsDMPf60PNboIBdi1pKAwftrgzPs9uDXPkwBHtgWatt27hhY4sxkAVkk
cache-control: no-cache
cf-ray: 74994db5bd1659d7-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET googleredir
googlecm.hit.gemius.pl/ Frame 28A4 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 28A4 0
12 B 58ms
48ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lv8D0v67yZHuGYYwdWgPXS7uN5jfsfSiK0fYxTr9-NsdwnXu4dA-pWs5FmrbSrRhWuNDJhCA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 815B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

53ms
52ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
expires: Mon, 12 Sep 2022 14:23:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B70D
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizhcw-W6vDgpGTfgFuyb4&google_cver=1&google_push=AehlK4BZP6YDW0XTG_39Ev4RuSHUtz6SxSshnwtqO_TNoGBSSAD02SEHN5...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4BZP6YDW0XTG_39Ev4RuSHUtz6SxSshnwtqO_TNoGBSSAD02SEHN5W-Yb54xoqBiQByn2lnOM6RDSLlfhNCq2GkWS5Abt4&google_hm=N6GZf_EUsj8L9...

170 B
188 B

50ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4BZP6YDW0XTG_39Ev4RuSHUtz6SxSshnwtqO_TNoGBSSAD02SEHN5W-Yb54xoqBiQByn2lnOM6RDSLlfhNCq2GkWS5Abt4&google_hm=N6GZf_EUsj8L9_sGC7hNyw

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AehlK4BZP6YDW0XTG_39Ev4RuSHUtz6SxSshnwtqO_TNoGBSSAD02SEHN5W-Yb54xoqBiQByn2lnOM6RDSLlfhNCq2GkWS5Abt4&google_hm=N6GZf_EUsj8L9_sGC7hNyw
pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B70D
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAehlK4BopHAMFRpzhBQ5wPjXpKO3hUCpgmefNK32aOB-2AAIw8Q-eUPSl0H8GJXo_PoiPJhcDyrCtalENiSAsdSAheH1XQA1ECBa&google_gid=CAESECJUZJlK72Cg-rg38DdInD8&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCPmB_ZgGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BZWhsSzRCb3BIQU1GUnB6aEJRNXdQalhwS08zaFVDcGdtZWZOSzMyYU9CLTJBQUl3OFEtZVVQU2wwSDhHSlhvX1BvaVBKaGNEeXJDdGFsRU5pU0FzZF...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRlROVXZrd0xxRVVsSnBvNWNmQXZsQlR0MmRXTGtLMEpMdjVrSUNqdjZ3RQ==&google_push

170 B
188 B

51ms
51ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRlROVXZrd0xxRVVsSnBvNWNmQXZsQlR0MmRXTGtLMEpMdjVrSUNqdjZ3RQ==&google_push

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 12 Sep 2022 14:23:53 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwRlROVXZrd0xxRVVsSnBvNWNmQXZsQlR0MmRXTGtLMEpMdjVrSUNqdjZ3RQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B70D
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAehlK4ASV9D8...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ASV9D8p6yo7SsX2x_usdS6bzb1EQUaFxVSDI7V6BOP7qsG6yjtlAeWPH1Y-LOLCR...

170 B
188 B

49ms
49ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ASV9D8p6yo7SsX2x_usdS6bzb1EQUaFxVSDI7V6BOP7qsG6yjtlAeWPH1Y-LOLCRNNWKBJH9NjJ0I8CSpd1dshMR2rI2x5

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA5MTIxNDIzNTIwMDAxMDAwOTgyNzA4NA%3D%3D&google_push=AehlK4ASV9D8p6yo7SsX2x_usdS6bzb1EQUaFxVSDI7V6BOP7qsG6yjtlAeWPH1Y-LOLCRNNWKBJH9NjJ0I8CSpd1dshMR2rI2x5
pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 12 Sep 2022 14:23:53 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame B70D 43 B
64 B 50ms
44ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEFGHPnHWtGl1fAbyP7Mtw9k&google_cver=1&google_push=AehlK4CBF6AfrtN8vFdqj7hnaEBpJ_nu4Y77K9log8AYaNXUqJ1UJcM_AUDIJ7zun2CyTNqng0k-FEienw4e1zAiIJpeo-erB6k
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:52 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: pr63grg4mho2ne7ercu028ae30jic02d

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame B70D 0
41 B 47ms
39ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEK4e9GgwL1fc0yOrOgLmV0A&google_cver=1&google_push=AehlK4DLDKcWRj9AtcWngtJO6n1ZDl9RRhaSMGTSL8xCzn4pYAbo9daLeNmRpIPtoCepUpRhy7N0fEhoD_2tuOwCSORq8oxbJc_U
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=353&adk=558797056&adf=1279521998&pi=t.aa~a.4070651048~rp.4&w=1038&lmt=1662862591&nsk=eef77872&rafmt=11&pwprc=6266461316&psa=1&ad_type=text_image&format=1038x353&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1992&idt=2&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280%2C353x280%2C353x280&nras=6&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=90&ady=1912&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=ypgSZeUfwu&p=https%3A//www.redpacketsecurity.com&dtd=53
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B70D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO-zZLIkBBMws974oDxgT0Q&google_cver=1&google_push=AehlK4DxZh4z5BJA8SwNK8tISa2XMVuUSvGHUG92T3y7T2HA2imLIuID3OdTg4U7ng1PgcDAoR5...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNFYtMjUtSElCRA==&google_push=AehlK4DxZh4z5BJA8SwNK8tISa2XMVuUSvGHUG92T3y7T2HA2imLIuID3OdTg4U7ng1PgcDAoR5oUkItr5aNjRBo9VJ663srt7bi

170 B
188 B

62ms
60ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNFYtMjUtSElCRA==&google_push=AehlK4DxZh4z5BJA8SwNK8tISa2XMVuUSvGHUG92T3y7T2HA2imLIuID3OdTg4U7ng1PgcDAoR5oUkItr5aNjRBo9VJ663srt7bi

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDdZVVZLNFYtMjUtSElCRA==&google_push=AehlK4DxZh4z5BJA8SwNK8tISa2XMVuUSvGHUG92T3y7T2HA2imLIuID3OdTg4U7ng1PgcDAoR5oUkItr5aNjRBo9VJ663srt7bi
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B70D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BHcWcAk8NDqjvQDIc1hQzgukbvT1Nts...

170 B
188 B

63ms
47ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BHcWcAk8NDqjvQDIc1hQzgukbvT1NtsOUfPAcVsOvV8leJ9VMfM44S-5HUgFUZZgFyd0_4hOzTqizkolBfkg5BO6RrVswa

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DlsMaY7G9fNVXKsenoB9P3jUuhzlRMEk9nMlUaPpanvgCBQrHorvORqfAXe0GjgiupsyaJUlm61UjpnR4kS9TjhbbPkg2wk2i%2BPBsrBcBSf5QoGzTxIOiVB1%2Fs2a5GCMgWLV6i4STxoM%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIB2V25WPhQGlCk8X2ZCB7s&google_hm=Yx9A-K6wfBsqag-AROpmAwAAEXEAAAAB&google_nid=index&google_push=AehlK4BHcWcAk8NDqjvQDIc1hQzgukbvT1NtsOUfPAcVsOvV8leJ9VMfM44S-5HUgFUZZgFyd0_4hOzTqizkolBfkg5BO6RrVswa
cache-control: no-cache
cf-ray: 74994db5bd2959d7-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B70D 0
12 B 51ms
45ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IbuszL1lFpNXA-HK8kjCyQIhjcbE-HYVqegF8E4Y18M5XXDOvxV2vKaZ9k7Wd9WqlE27Kj

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 14:23:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 12D1
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

85ms
84ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=4029085294&pi=t.aa~a.2402295283~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=2&bdt=1993&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280&nras=3&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=1642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xd70XHS9Pl&p=https%3A//www.redpacketsecurity.com&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
expires: Mon, 12 Sep 2022 14:23:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8C44
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

60ms
55ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1536334219562771&output=html&h=280&adk=3106563156&adf=1025710575&pi=t.aa~a.1081604991~rp.4&w=353&fwrn=4&fwrnh=100&lmt=1662862591&rafmt=1&to=qs&pwprc=6266461316&psa=1&format=353x280&url=https%3A%2F%2Fwww.redpacketsecurity.com%2Fcobalt-stike-beacon-detected-179-60-146-51-port-443%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1662992631830&bpp=1&bdt=1992&idt=-M&shv=r20220907&mjsv=m202209070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc4b8681898813936-2243a6e01cce0030%3AT%3D1662992631%3ART%3D1662992631%3AS%3DALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg&prev_fmts=0x0%2C1200x280%2C353x280&nras=4&correlator=8234742624287&frm=20&pv=1&ga_vid=61575201.1662992631&ga_sid=1662992631&ga_hid=1455312046&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1198&ady=2657&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31069447%2C44770881%2C44772928%2C21066430&oid=2&psts=AEC3cPLRanuDB1sfYJNjOarH_FcC6MYVDmIsKXHvbrB9JHw6IjY1Nvf3zDjT7hb7p75CNTl1tmmwzmKgXkqQrumfoA&pvsid=261561337798831&tmod=1949428121&uas=0&nvt=1&ref=https%3A%2F%2Ft.co%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=SBiZeaWDEM&p=https%3A//www.redpacketsecurity.com&dtd=43

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
expires: Mon, 12 Sep 2022 14:23:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DC69
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

64ms
58ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
expires: Mon, 12 Sep 2022 14:23:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 12 Sep 2022 14:23:53 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js Show response
pagead2.googlesyndication.com/bg/ Frame B3C5 36 KB
16 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JI0Pcydj_YJwFyiv8pAtPmsHnnPx6gDBxLt0n0XpIm8.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 11 Sep 2022 22:10:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58424
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15957
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 11 Sep 2023 22:10:09 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B281 42 B
64 B 91ms
86ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsulfrQwI7WaOwbFjvdMNvFRicbUCwpf7Tf8mLewEmM1UHMpaAvs_hERJCwWoV1pU0OEZdMQOjhrkDSXSEKjR_RiUK8-JHrUQJM0NVQVMwgOmFOFFSfL2VnaOHtzdXFu4W5cn_FtGrGqqvLs4ET9YNne29-KDsvT6eLiDQ&sai=AMfl-YTyFuJLnTV3uXt8TbQjzZLGFTRQtA0OUBHmJMv5iIMWm_zUqeu4hwh4dJM1yj2GwADvk8VNeydLUM5mC8tRhcYVB80kWnqT780&sig=Cg0ArKJSzLaNIO2584myEAE&cid=CAASF-RoVmxMOL7yFlj9r30CBzG-IcjT7_4g&id=lidar2&mcvt=1001&p=0,0,280,1200&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=4131350476&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662992631132&rpt=1126&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FD07 42 B
64 B 74ms
74ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstbJJTUKlFBnjSw2Y1hFb4jAUSQwdM_WKnW5N3f1X_GvekGPMh3PxNJn-Rh8oaay_GG8Kkr3gNnIctp6rm2B9LZXkuaV3X_h_sgtHzAj77DKiz7PLsT-XWdWdpS1z_CWB_K7Ot6yw&sai=AMfl-YREQd8Nag6kc59P-Q_zvbRmCh2M9cCbXcNx-Tv4GE0F7b5V9XjwoHf_C3UT27vcrhxPGHANXL-QtgXtTDYRMAzYWu9QLzX3W68&sig=Cg0ArKJSzJn6krdQ2ygpEAE&cid=CAASF-Roi_jeKxkHxmuJzG1YeNIT3XXbciEh&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=292,863,1000,1000,1000&tos=292,571,137,0,0&v=20220907&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662992631948&rpt=521&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Sep 2022 14:23:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECZtHydcz75jzm_FLOcwAUE&google_cver=1&google_push=AehlK4Bv00bhBdtMD_jL1Vc0gPI6tS1_2juBS-ZhOhcrKpPQJxyJcUFrWWxqTqxe0QtQ5v90YkAZd3kG-RwI4NgLKCNA2SCqHNJlog

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECZtHydcz75jzm_FLOcwAUE&google_cver=1&google_push=AehlK4BXlZ93LaRW12YA4YDejV5leCp-uIkbvTdYowWzYMg2ZRG7VzZ_CdAj40VN2aOmbjyAHCcqh3pZcIde5Apfb_lbvbN9gSo

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECZtHydcz75jzm_FLOcwAUE&google_cver=1&google_push=AehlK4BDvVDQaLiXpLVP-Prnz3fZMCUXDQ4kCYofEDTknx0sz25EFQIxQI1pGuaQgSH1fHmfBgCP78ED3nZFZiymNm8HUMFNIp1o

Verdicts & Comments Add Verdict or Comment

87 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443	1969-12-31 23:59:59	Name: _ga4s Value: 1
www.redpacketsecurity.com/cobalt-stike-beacon-detected-179-60-146-51-port-443	1969-12-31 23:59:59	Name: _ga4sid Value: 2144734908
.t.co/	1970-01-20 15:26:47	Name: muc Value: 25862b7f-c0e2-4d5c-b925-2face581f96b
.redpacketsecurity.com/	1970-01-20 15:32:32	Name: _ga4 Value: 5e1c0742-9c52-46c7-a53c-98ac693cc204
.www.redpacketsecurity.com/	1970-01-20 06:39:44	Name: CaosGtag_ga_GN0W0LT7ZX Value: GS1.3.1662992630.1.0.1662992630.60.0.0
.www.redpacketsecurity.com/	1970-01-20 06:39:44	Name: CaosGtag_ga Value: GA1.3.61575201.1662992631
comments.app/	1970-01-20 14:30:22	Name: bcom_on Value: 1
.doubleclick.net/	1970-01-20 15:18:08	Name: IDE Value: AHWqTUlnlfS5t84FJAJBDy2kilfIBEAhbow62yqIhCI4eNJVYgc_NySf-ZqXaFNe
.redpacketsecurity.com/	1970-01-20 15:18:08	Name: __gads Value: ID=c4b8681898813936-2243a6e01cce0030:T=1662992631:RT=1662992631:S=ALNI_MY63nTQtNU5GBDifhtY70TwWZSGpg
.redpacketsecurity.com/	1970-01-20 05:56:34	Name: __cf_bm Value: YN24NYYf_WZRJRG8.l4g4xCEN9Gj9KE2HxCn7mcObRM-1662992631-0-AW+lvGv0yIJdWDK6Dl/T/+S87rjcKj4t9JxuTfXdwBvlhKjR4vwkpRQLhYfEpRcsx8MOjHUMP3a59V2EtSFZpBBg51RRZsf98z4IVssib5qht1XlGaLsklvx5Kfzn/doZw==
.quantserve.com/	1970-01-20 08:06:08	Name: d Value: EDUBCQGKJ4EA
.quantserve.com/	1970-01-20 15:26:47	Name: mc Value: 631f40f8-084df-4f7a6-79676
.casalemedia.com/	1970-01-20 14:42:08	Name: CMID Value: Yx9A.K6wfBsqag.AROpmAwAA
.casalemedia.com/	1970-01-20 08:06:08	Name: CMPS Value: 4465
.casalemedia.com/	1970-01-20 08:06:08	Name: CMPRO Value: 4465
.doubleclick.net/	1970-01-20 05:56:36	Name: DSID Value: NO_DATA
.e.dlx.addthis.com/	1970-01-20 15:26:47	Name: na_tc Value: Y
.addthis.com/	1970-01-20 15:26:47	Name: na_id Value: 2022091214235200010009827084
.addthis.com/	1970-01-20 15:26:47	Name: na_tc Value: Y
.addthis.com/	1970-01-20 15:26:47	Name: uid Value: 631f40f852563530
.addthis.com/	1970-01-20 15:26:47	Name: ouid Value: 631f40f8000142a3888ed250164d018c31f0250c347592167653
.dlx.addthis.com/	1970-01-20 06:39:44	Name: na_sr Value: 20220912
.dlx.addthis.com/	1970-01-20 05:56:32	Name: na_srp Value: 3614
.casalemedia.com/	1970-01-20 08:06:08	Name: CMTS Value: 4514
.rlcdn.com/	1970-01-20 14:42:08	Name: rlas3 Value: fT8lvYGF/3ILlYzIL9MasAvUoKUDytkK/mtgVBj7QFc=
.agkn.com/	1970-01-20 14:42:08	Name: u Value: C\|0CEAqsf15KrH9eQAAAAAAAQ13AQCAAQpAAAAAAA
.agkn.com/	1970-01-20 14:42:08	Name: ab Value: 0001%3AK%2FUzI6XALpam0PzIJ%2F0dA4qVPyhcDi%2B3
.dlx.addthis.com/	1970-01-20 06:39:44	Name: na_rn Value: 1
.dlx.addthis.com/	1970-01-20 06:39:44	Name: na_sc_e Value: 1
.rlcdn.com/	1970-01-20 07:22:56	Name: pxrc Value: CPmB/ZgGEgUI6AcQABIGCOndKhAA
.innovid.com/	1970-01-20 08:06:08	Name: uuid Value: 5df4918f-2fae-4c0e-9712-bee1a9733260-20220912 10:23:53

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECZtHydcz75jzm_FLOcwAUE&google_cver=1&google_push=AehlK4Bv00bhBdtMD_jL1Vc0gPI6tS1_2juBS-ZhOhcrKpPQJxyJcUFrWWxqTqxe0QtQ5v90YkAZd3kG-RwI4NgLKCNA2SCqHNJlog Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECZtHydcz75jzm_FLOcwAUE&google_cver=1&google_push=AehlK4BXlZ93LaRW12YA4YDejV5leCp-uIkbvTdYowWzYMg2ZRG7VzZ_CdAj40VN2aOmbjyAHCcqh3pZcIde5Apfb_lbvbN9gSo Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECZtHydcz75jzm_FLOcwAUE&google_cver=1&google_push=AehlK4BDvVDQaLiXpLVP-Prnz3fZMCUXDQ4kCYofEDTknx0sz25EFQIxQI1pGuaQgSH1fHmfBgCP78ED3nZFZiymNm8HUMFNIp1o Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
javascript	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20220907/r20110914/zrt_lookup.html?fsb=1#RS-1-&adk=1812271801&client=ca-pub-1536334219562771&fa=1&ifi=9&uci=a!9&btvi=5&xpc=jm2YyBlwYG&p=https%3A//www.redpacketsecurity.com Message: The resource https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.it
ag.innovid.com
analytics.google.com
cm.g.doubleclick.net
cms.quantserve.com
comments.app
d.agkn.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
id.rlcdn.com
image6.pubmatic.com
oauth.tg.dev
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
rtb.openx.net
ssum-sec.casalemedia.com
static.cloudflareinsights.com
stats.g.doubleclick.net
t.co
tg.dev
tpc.googlesyndication.com
www.google.com
www.google.it
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
www.redpacketsecurity.com
googlecm.hit.gemius.pl
104.18.19.126
104.222.176.10
104.244.42.5
142.250.181.226
142.250.185.162
149.154.164.13
172.217.16.194
198.47.127.19
2001:4860:4802:32::181
2606:4700:20::ac43:4810
2606:4700:440e::6812:2fe6
2620:116:800d:21:de2e:c7b3:55c0:d5a0
2a00:1450:4001:803::2003
2a00:1450:4001:806::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:813::2001
2a00:1450:4001:813::2002
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2003
2a00:1450:400c:c07::9c
2a00:1450:400e:800::200a
2a05:d01c:1d8:8100:3f19:5c6a:796d:22bb
34.98.67.61
35.157.16.92
35.227.252.103
35.244.174.68
52.48.82.83
69.173.144.139
69.192.160.219
00ab36d5573ceab85b1bc2de3ff62f4a9402bdc7c8a9749ac58c7037aa4bd2b8
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
04aec4107954c62d888f138cac63e9fd4508ca8bfcdaf9a9e3ade5eed2333b79
0794a03109ae7d8466b5d5e2403efb4c9bfa56217912e28bf3fa611b9804da7d
09007b83810c6282ed1a6e380c96d9c8b5f086edc0d619fecd40f9d4d805882b
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
13ea1503dc13c1d5259d6d10430aadc0fe269a78016fa6b7e0a41d653c6a7001
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1dc4b29dd0acbed77ec2fd81036c33efd4ab5989e8182705a30615a00a0117f7
22fdb7dc8a0b227d7bd1026090cd0105f12bfcc6966b33402653ca496ce16265
238097b6e56e527a0e0d9bb97d45c28c9cd3cb1bfae8e360ce19f49e1a540a3f
240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5
248d0f732763fd82701728aff2902d3e6b079e73f1ea00c1c4bb749f45e9226f
24edfcf6c3ff1d5bba9330be3f3e481b50962a9049c9b575e0040b13ad3dcd21
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
38bc64c56d310172249705bc1cdd02ab368c26550ebe05c708c0703049edc79b
39515923a7a6d6b0fc527d9b4387b7eae4d1983ee8cdabadf214f01f9f633357
3c46b18a1ccba221be436881e1649ef1bfd1e656184fcd535e84bc77c77e8e5d
41e6b6d767624abc8bc9186dbb7dc68dfa088257c84850b275c89e3fa6a7d44f
4247183ff111bcf12affd18ba0da4a7a1ff0b4e7e491db67b9562b58d6a29c88
4262de2c2742c8984c040473e241b03ece0e5103a42e2af7211d3edf14d4dc0d
42f0cb1bc94d52bd78d92d74a31f2b7abe168da76fc3dbd4840fa540b5a32ae6
437e2f919345cdc64ce4cc4de32598b6c99b2962f3e209c4c2efe4eeb4db7971
46489b4c55fb6dce029c4ebcaa74c9616a0a89dc3be3e0027d0113c698ed9968
46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2
482f450b7fdbac6f9304643f3e731df20bf66c51fb0599fa9a734e5d102a9e2a
48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4b6d6a3b14e178b8b51949af934301e746499da85565722ad3ec29a61d32b89c
4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50f77fa9d32c1323f7e50da8d807f556cdddaea2161de6cf84a0c8b4c1dd6f79
53f99c06b117d5fe6c03a076cf0ca898bb03a36aaf3004bd40de783bac2879bc
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
54cb0643a7f536436b00df60b5bf7d1c37f71d9cca5bc05246f958a2573d0fa4
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
578ece1ba13e8a1dd211785e2df101ac5f9d1f2e387f9c6557bf51637ad0b84b
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5bc49569048b009b78cf88826f421495bafb16335cb08a68e8fcf9ece6954ad9
5c3e4ab5128dd3d93d7221f762a5603aca4b7bc685d2190628b243ebebd6f463
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c5baefabe2fb32542b7939f79f759f9ee99785d27b654c48683870fcd90ce7a
60c62e0e44a2b4a1116d28f8a69f20c108cc84b5c173060d134a6ec083e12240
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62192a35a334d4401e348cf6774b25795b248972e116befa3405d9b9128a5473
629a298422d20d6be3aad025c6ddce8681991408627b1bf76f3e88abce039d2e
6342d16a93416b5e826f6d0e0e930ef033efb682851ae46270f3c4f5b4a1c194
6c1e31700f68d1666de6b0992e89d413434707718bf729a472404029845bdbad
6d53299eeb9516dbba670ceeb55e8e5ce2186edb71518f6a1bd16553308f17c2
6fecb89a29ee2bd397bb1bf58ecaa530a76f0654db71fadefd3cc70b0bc302bf
72f9eff3310a83b226f6209be6064a9aa6f3724dd5eb0c69e6390713f104f6a9
76216b6c25b768e5bee4b758dacfef993b3e87cc2d7fd9bf192bd685d1ae9bfb
7688d6c0bc721a9708d4f280bfc926b6bb25e2386300a906a7fe5fa31a334bc7
7d45256c95c1c245654bf298e27d9c538dc778a2ee050ba4678ac2a07f479869
878507828632957a2a0e471f1bfef8ef64ee4726f7fd03d05d77664823079fa5
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8bdd5a651bcebd9e1ecd443172bd4c983d64765f04c28e1b55a0a63467e4d035
8c5c420bf74b4876ce199eddfe6f26cb10118ad6bc930e343cc4d438b18651ce
9186fd23b9aae0b0f032ecc83f1a387b8e39fa4825e4245e981083f622c02482
93ba08191a5ef1ce0034cf78e4d75f6dd285de83ece5068078061267d0931676
9458e4a7110139117874fea223859e635e0d424c56d8bc89fc2cca4113aca2af
9691e8c38e89f0117aa9aab7dc706fa84ff4c18279a0769cfd90579c897922c1
975fcd769077c94bff0b689fbe3ad59e461ea7c948870bd979d21ad4716ecee9
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
9a3b66ba4b11d791582866a37f142c53d18eb40fb69c71fd81ef2de008b9a090
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b67a14d3266023e71ecdf6bbb6376034a486e07e1da880f536af90fb1c07711
9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134
9c5cd3351a343011cbc0046d12c2b8bc8d7a968a09009ddb117fb1dc49fd1333
9ddc0f6530a2a949a60ecc192689aba25551e0f9f6270b44803134b27708d883
9ff63db6d5d33a23abed01b2ce8ea4745bada82996fcfe8c92b9313fc505024f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a144d17625e107b84cc33e980375f347a886c44cc806a438dd13322840a0f67a
a3a9666403dd904811c01ba6925d89449b27aa3efe19e86b9d8864d660922fc6
a47d18ece2a7fe68cf7ed4fd9ee99e80d73d5e7662fedbddbb9d9de459ed2299
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
aa441bf5f2ac8c608371513bad73ea45ad6dc8b7c50e3c6841af81147d0b96ce
aae40e723f2a24aa6da4a34cdfd46d7d9c8b43e7e67d8e6d34253c300059f008
ace0366eab1ff253f3ccc456913f0cd991bd1ead16846297ba62c40e2f0dcd5b
ae394bf43bc39f7c6b3f439de04f6b75288d849a0ecae5000a2452546063647c
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
af12f7592b4d8f6b8483bd9bab081ecf35abe485d5315fb0ecf30559ac2bd9cd
af468a53ff8b21e58d333969b462d31f6d23e94d0f255e58b8c9242057d29c34
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b28d8e93ecf9067ff746e514c79ad5adc53cc00965630bfe0b118cf80f7bf065
b2be9c7c3f5b1cfa7055b5f64d499416c9b680b0b6030677c323164358f49a99
b30169a38c7ecd17eefc119177c0c61337b17a8f1abfd337ac37284d1a04a65b
b5e930df6a2976d5df996e18b347e091756699ea32716dc53d0e1c0fd814c526
b9983e0f3bd212e1f920657c96ca9b0f3ef62e4b6ebbd153abd0f1791ecac4a4
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c4def69ddb2d0d015b7d3361a2074cc9235280d520c2c419f2eab67fa5ec3bc3
c6e098655bf365af10393cec5be569becfba92d4b3374f5f409ceaa5a3b3bad6
c84c1026e0a4c60ec0ee85c8b41c1904144aa63184260c95840924b42bd32d33
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d24212e604ad9c37a8c3f2f403bc8155fea8a2df82e15e9eb0e5a55a9fd75143
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
d8c5def060c0f2874b37ae3a7f0977c60544572e495b0ce66626305fc46755d1
d951736694abf6e078c76c38dc0c83979714734d020a73d59d066f652c75e3b0
da3e511b908f924d06bcd56a2274b737f070823715600c460dc5d593b276f961
dc347f44b69a17cc59ec70c5b0997f9533efbacbe03214a8dce362eeff6c81c9
dd6e691a27d07125e04993917cfb3f75ac9d8926f6b66d7c2e45368aa130e660
de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f
e064f51bb41b701150f1fc3d2b77240b64367aa04f15c6df851b99b4875605ca
e137ed642ca3ffb83b012c58226864e4525807419ed4836c4621aee7087788b6
e28b35a3da8773aebff732255cd50f4693c5bc2b6906f7a0d2b9f76060d0a2e2
e348d772480f8c0e5fa546b3c531a38700ae16b5dad5defb5e67ade7f6d332e8
e368951bc5918b3d9fbc8205bfdf0d8be8b79da09b457bb113307063f3b1bc89
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e450af4a7c4974ea3ff324b629876380e0ca9605333a57152a953310c4a4661a
e5b8d31d7c9bfba8942e33a8a2109e0ea2b895e8d56081fe3bd87ebc692b7aaf
e8dfa93e316db0c0dd5d74f51997783f3517b8db6c7fa2461898ae5109c0b429
e9d9a4ac74e536c050e8c6c9a95941e5009411ae61e9c2bcd8371f638b2ec661
eac0322beff650b42ae088317d82c6bf6cfeac6c2bd3071bdf126827b2eb81d0
eb46d82ef6f86859f18e379660e0f45b85c6f69fa97111905f0c125a08506376
ec9ae04448369cfd061688be0e2203a5696e42a15d1c179e7ba7849acb2c63cb
ed2113aa9397e24527500bbb87bd9a0a2b014d1bd3a0da1aedd2ad1d53d88da6
eee2832920de823a77ade71ddf71f135ef58d3d7aa14c2e48036e1faec3c2762
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1c5e16c3abc728ef3c7eb1ff66fc5b15f08232156bae6493e37becbd1b2f01d
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a
f4fa2768879ae058b28e26435993114f2a868aa56a2ff051332a1beb6a409dce
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7ec795d6ca0df8d0083c41b1a57aed9a3500897442639a0c24999a749eed08a
f84781d3e65130fbcee9c8813916246764b2e335a6a4827009f817c3ca74c3f0
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fe85646af222500a866fd63beedb6ae00576c4afab4e0d28b15d9d6d92cb7da5

www.redpacketsecurity.com Open in urlscan Pro 2606:4700:20::ac43:4810 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

283 Requests

89 %HTTPS

52 %IPv6

25 Domains

34 Subdomains

26 IPs

6 Countries

3043 kBTransfer

7567 kBSize

31 Cookies

11 Outgoing links

Page URL History

Redirected requests

283 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.redpacketsecurity.com Open in urlscan Pro
2606:4700:20::ac43:4810 Public Scan

Screenshot
Live screenshot

Full Image

283
Requests

89 %
HTTPS

52 %
IPv6

25
Domains

34
Subdomains

26
IPs

6
Countries

3043 kB
Transfer

7567 kB
Size

31
Cookies

283 HTTP transactions
9 data transactions