www.zdnet.com Open in urlscan Pro
2a04:4e42:4d::666  Public Scan

16 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 104

• https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699368.318388975;dc_trk_aid=510968212;dc_trk_cid=160531770;ord=740876021;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
• https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699368.318388975;dc_pre=CLTx44SRrPQCFZpk4AodKx8LBA;dc_trk_aid=510968212;dc_trk_cid=160531770;ord=740876021;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 165

• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1

Request Chain 166

• https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
• https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZuiyNavuihB01qP1WJQywAA HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1

Request Chain 167

• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
• https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1

Request Chain 168

• https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
• https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D

Request Chain 178

• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1

Request Chain 179

• https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZuiyNavuihB01qP1WJQywAA HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1

Request Chain 180

• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
• https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1

Request Chain 181

• https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D

Request Chain 186

• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1

Request Chain 187

• https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZuiyNavuihB01qP1WJQywAA HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1

Request Chain 188

• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
• https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1

Request Chain 189

• https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D

Request Chain 190

• https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
• https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPl9FYpbtzLhL8bPe5L46g0&google_cver=1

Request Chain 191

• https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
• https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWQ0NzJkNzMtYjk0My0yMTIyLWU5YzUtNjgyOTQ2MjllNDI1

Request Chain 192

• https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm HTTP 302
• https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuXL4MBq_LsG_5aE_Rq-X8&google_cver=1 HTTP 302
• https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuXL4MBq_LsG_5aE_Rq-X8&google_cver=1&__user_check__=1&sync_id=ba03ae5d-4b9c-11ec-b520-156973b60106

Request Chain 193

• https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID HTTP 302
• https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_id=b9fb27f8-4b9c-11ec-a79e-1d21b9eb0206 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YjlmYjI3YjktNGI5Yy0xMWVjLWE3OWUtMWQyMWI5ZWIwMjA2

Request Chain 286

• https://rtb.openx.net/sync/dds?google_gid=CAESEDRk3IWURAuHUE1p7VdPeOk&google_cver=1&google_push=AYg5qPKVgXQiRNrHrDLmDMh9iPprJAveGctF2BliIM_zN5HXp09t65o3Tsw7QeJVIPOpgEReYZX5H7kRuMg3T47WKZxq9L_3Za6D HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKVgXQiRNrHrDLmDMh9iPprJAveGctF2BliIM_zN5HXp09t65o3Tsw7QeJVIPOpgEReYZX5H7kRuMg3T47WKZxq9L_3Za6D&google_hm=Xn50hdmyxqgaUX4nX9IQ_w==

Request Chain 287

• https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBx2uXzkv3aHWWXCyDQ99kg&google_cver=1&google_push=AYg5qPJ7ZdwTY_kPODvzRScWEnfzlM7acyBVhcIF55CLZVkqvrVdFrq2vlFwMiQXFmTY_diKktBhDHwU1ciL_evaeJd0byp_RRxE HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dBUU1OSjktMVItOTIxVg==&google_push=AYg5qPJ7ZdwTY_kPODvzRScWEnfzlM7acyBVhcIF55CLZVkqvrVdFrq2vlFwMiQXFmTY_diKktBhDHwU1ciL_evaeJd0byp_RRxE

Request Chain 288

• https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEGA9EyjXp-YiTDoEOemCjxc&google_cver=1&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ4XpFj4Nc3UwWAUHtLN790skimaWIRfgChWbPCof2 HTTP 302
• https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ4XpFj4Nc3UwWAUHtLN790skimaWIRfgChWbPCof2&google_gid=CAESEGA9EyjXp-YiTDoEOemCjxc HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjM5MTQ4ODkxMDY0NzM3ODcyMg%3D%3D&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ4XpFj4Nc3UwWAUHtLN790skimaWIRfgChWbPCof2

Request Chain 289

• https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENNfqmMTnrwZbXN_Vw4CU1o&google_cver=1&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9edkz5ZDCBbmuFHXaM3bCeawtZIlT1x1EkJDV7c3f3cpVfKg HTTP 302
• https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENNfqmMTnrwZbXN_Vw4CU1o&google_cver=1&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9edkz5ZDCBbmuFHXaM3bCeawtZIlT1x1EkJDV7c3f3cpVfKg&verify=true HTTP 302
• https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENNfqmMTnrwZbXN_Vw4CU1o&google_cver=1&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9edkz5ZDCBbmuFHXaM3bCeawtZIlT1x1EkJDV7c3f3cpVfKg&apid=UPba46dc2f-4b9c-11ec-9a64-06ff4103d6f8 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBiYTQ2ZGMyZi00YjljLTExZWMtOWE2NC0wNmZmNDEwM2Q2Zjg%3D&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9edkz5ZDCBbmuFHXaM3bCeawtZIlT1x1EkJDV7c3f3cpVfKg

Request Chain 290

• https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEDqgzQKJcVpdQpPtsUAKqdo&google_cver=1&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwEq74l_PNjhQ4kQYdjJg_ZZVta3sSCV7B-fQECaBPcD4tzA HTTP 302
• https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEDqgzQKJcVpdQpPtsUAKqdo&google_cver=1&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwEq74l_PNjhQ4kQYdjJg_ZZVta3sSCV7B-fQECaBPcD4tzA&verify=true HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1oN284U3VSRTJ1RTZoMmt6TDNfWmtCelpxVHA2Z2p2Vn5B&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwEq74l_PNjhQ4kQYdjJg_ZZVta3sSCV7B-fQECaBPcD4tzA

Request Chain 373

• https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pdfvc5v74 HTTP 302
• https://rdz4muqxedxjqym3ulfa-pdfvc5-76ceaa3e0-clientnsv4-s.akamaihd.net/eum/results.txt

Request Chain 374

• https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pdfvc5v74 HTTP 302
• https://fiaqj6accidy4kqce3ygyaaaabqzxiwl-pdfvc5-0d0e0f807-clienttons-s.akamaihd.net/eum/results.txt

376 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/	240 KB 93 KB	564ms 534ms	Document text/html	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f9ed41ad9b458974ac0d691f4b822a08828b701abdd6c96ff6dd86e694b9483c Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" link <https://www.zdnet.com/a/fly/css/core/main-c3419f1987-rev.css>; rel="preload"; as="style"; nopush referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id 9f1ecf8a-04d3-4f5e-b3ae-967e1a04dd12 x-xss-protection 1; mode=block date Mon, 22 Nov 2021 14:01:42 GMT via 1.1 varnish cache-control max-age=5400, private expires Mon, 22 Nov 2021 15:31:42 GMT strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent content-length 93893
GET H2	200	main-c3419f1987-rev.css www.zdnet.com/a/fly/css/core/	318 KB 54 KB	7ms 7ms	Stylesheet text/css	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/core/main-c3419f1987-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 3c2c275622093f9012768ff2e30be9dafee750f18b0938feacb193559db34ebd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 54512 x-xss-protection 1; mode=block last-modified Mon, 22 Nov 2021 10:11:19 GMT server ContentServer x-frame-options SAMEORIGIN etag "9769ec9773ddd742e165f11471192906" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 29 Nov 2021 10:12:58 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	19 KB 7 KB	38ms 21ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0b19d7b02efa2e63180e064f2801718bccb6fd3c2c307ee41110e21e2e4ad390 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 22 Nov 2021 14:01:42 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 Lh0CEVPkmGuwf4KyqdKdhw== age 10 vary Accept-Encoding content-length 6403 x-ms-lease-status unlocked last-modified Fri, 19 Nov 2021 15:53:32 GMT server cloudflare etag 0x8D9AB74BCB270F7 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 75937fac-201e-00a4-456d-dde202000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6b22b0fb7fac694c-FRA expires Mon, 22 Nov 2021 18:01:42 GMT
GET H2	200	optanon-v1.1.0.js Show response www.zdnet.com/a/privacy/optanon/	36 KB 10 KB	6ms 6ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 10444 x-xss-protection 1; mode=block last-modified Thu, 04 Mar 2021 19:22:21 GMT server ContentServer x-frame-options SAMEORIGIN etag "46e2aa30cbebb708b5fc468d57d56d8b" strict-transport-security max-age=31536000 content-language en via 1.1 varnish cache-control public, max-age=86400 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type application/javascript expires Thu, 18 Nov 2021 07:05:01 GMT
GET H2	200	controls-776b8acae1-rev.css www.zdnet.com/a/fly/css/video/htmlPlayerControls/	25 KB 4 KB	7ms 6ms	Stylesheet text/css	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-776b8acae1-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash fa3c2e6e0681eb8d99c0bc06918e317abac8bd4d184290d05d21cf94a490f023 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 4312 x-xss-protection 1; mode=block last-modified Mon, 22 Nov 2021 10:11:20 GMT server ContentServer x-frame-options SAMEORIGIN etag "6b3cd412d6f22e97e56b3ff8d8a63f9e" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 29 Nov 2021 10:12:58 GMT
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame 1B38	205 KB 50 KB	35ms 19ms	Script application/javascript	2a02:26f0:6c00:1bb::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Akamai Resource Optimizer / Resource Hash 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:42 GMT Content-Encoding br Last-Modified Thu, 14 Oct 2021 03:09:47 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 50393
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H2	200	charlie-osborne.jpg www.zdnet.com/a/img/resize/27f2f9869492e9ec2e683b630dbe4c94d7c8b98c/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/	712 B 988 B	11ms 10ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/27f2f9869492e9ec2e683b630dbe4c94d7c8b98c/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/charlie-osborne.jpg?width=40&height=40&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 6edbe2f6d2afbae11a835d9caac9e1b4f558ca7e0c2e14bffcc504e90c5e55dc Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT via 1.1 varnish fastly-io-info ifsz=11429 idim=350x250 ifmt=jpeg ofsz=712 odim=40x40 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588631330699120 fastly-stats io=1 content-length 712 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "aJHT6WJVbrTAFZXqDqRHlQqSYKIQZUb15eLJhqiDWC0" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Tue, 16 Nov 2021 09:07:39 GMT
GET H2	200	require-2.1.2.js Show response www.zdnet.com/a/fly/js/libs/	16 KB 6 KB	6ms 6ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:24 GMT server ContentServer x-frame-options SAMEORIGIN etag "d26a03e3dde83df4c1ead820882fb0f4" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:20:57 GMT
GET H2	200	mag-white01.png www.zdnet.com/a/fly/1637575705-asset/bundles/zdnetcss/images/core/	1 KB 1 KB	7ms 7ms	Image image/png	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1637575705-asset/bundles/zdnetcss/images/core/mag-white01.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-c3419f1987-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-c3419f1987-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 943 x-xss-protection 1; mode=block last-modified Thu, 18 Nov 2021 20:04:42 GMT server ContentServer x-frame-options SAMEORIGIN etag "2b3d6fa78213b58d79b72d8fb387d4b2" strict-transport-security max-age=31536000 content-type image/png via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 29 Nov 2021 09:31:34 GMT
GET H2	200	logo.png www.zdnet.com/a/fly/1637575705-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	6ms 6ms	Image image/png	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1637575705-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-c3419f1987-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-c3419f1987-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 4140 x-xss-protection 1; mode=block last-modified Thu, 18 Nov 2021 20:04:42 GMT server ContentServer x-frame-options SAMEORIGIN etag "6a582a0d8cb133a611ac4908a72c795f" strict-transport-security max-age=31536000 content-type image/png via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 29 Nov 2021 09:31:34 GMT
GET H2	200	Regular.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 6ms	Font font/woff2	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT via 1.1 varnish vary Accept-Encoding, Accept content-length 20256 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:30 GMT server ContentServer x-frame-options SAMEORIGIN etag "2d636d9395b2da27ce67040250333ca4" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 16 Nov 2022 18:20:56 GMT
GET H2	200	Semibold.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 7ms	Font font/woff2	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:42 GMT via 1.1 varnish vary Accept-Encoding, Accept content-length 20344 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:29 GMT server ContentServer x-frame-options SAMEORIGIN etag "a96ff4477074c6395b7305d2d98fde8e" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 16 Nov 2022 18:20:56 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 2 KB	40ms 25ms	XHR application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 xkIaWO5Hr0+rNu9IdoYHdw== age 14103 vary Accept-Encoding content-length 1425 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:53 GMT server cloudflare etag 0x8D94223473B0939 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 6b7a330a-601e-004d-2d15-b61e04000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6b22b0fc0c424e6d-FRA expires Mon, 22 Nov 2021 18:01:43 GMT
GET H2	200	nr-spa-1212.min.js Show response js-agent.newrelic.com/	44 KB 17 KB	22ms 6ms	Script application/javascript	151.101.66.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-spa-1212.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ebfe453394ff1be6ef75d380ab7c5535aea0b51832d045f0d5d0ef7e6535969c Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-version-id wY72Ah.NJX5KzzqRFK3uhSo3Jh07tDe4 content-encoding gzip etag "8bd93bf0ecb2f4e971a2055a41402bb6" x-amz-request-id VG6YBKXNYMJ05RRS x-cache HIT cross-origin-resource-policy cross-origin content-length 16636 x-amz-id-2 CN/OtP3A9z0ShcwSC84Dp2716OPSVqHtXjTa3tL4kDFfrY9FTweTMDz1ynWsKHz8NETzizCEpEw= x-served-by cache-fra19148-FRA last-modified Thu, 04 Nov 2021 21:16:16 GMT server AmazonS3 x-timer S1637589703.058748,VS0,VE0 date Mon, 22 Nov 2021 14:01:43 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 6840
GET H2	200	main.default.js Show response www.zdnet.com/a/fly/141b7a-fly/js/	223 KB 70 KB	7ms 6ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a8a94d42c979e478050545342252366082c4e5f3aeff8dc27bae989a22f6ca34 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 71843 x-xss-protection 1; mode=block last-modified Mon, 22 Nov 2021 10:11:11 GMT server ContentServer x-frame-options SAMEORIGIN etag "69d1331f41888834905b1646c2da70bb" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 29 Nov 2021 10:12:59 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame 1B38	2 KB 1 KB	58ms 44ms	XHR application/json	2a02:26f0:6c00:1bb::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5458632&v=1.720.0&if=&sl=0&si=ccc0d954-fc69-459b-a52b-68537c6e1af4-r2z8au&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 75e720b2289aa3646ba175f5fd3980bc5a3c02ebb2d7f2f8e40446c615ee6572 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:43 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 871
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	164 B 373 B	55ms 35ms	Script text/javascript	2606:4700:10::6814:b944 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b94f9074fc2ef1b63132fc70fe244cc5d5322e5982a80b6273a45a935ae335f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 6b22b0fc5b64431b-FRA
GET H2	200	bidbarrel-zdnet-rv.min.js Show response at.adtech.redventures.io/lib/dist/prod/	607 KB 177 KB	41ms 19ms	Script application/javascript	151.101.2.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/dist/prod/bidbarrel-zdnet-rv.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 6c0cd7b80611259d4ccce9165e8b5dd062aad43e3e3e19a404fe967c49795d03 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront), 1.1 varnish age 182 x-cache Hit from cloudfront, HIT content-encoding gzip content-length 180330 x-served-by cache-fra19149-FRA last-modified Thu, 28 Oct 2021 17:15:17 GMT server AmazonS3 x-timer S1637589703.111993,VS0,VE12 etag "873be44731952ce6844f825d0be702dd" vary Accept-Encoding, Origin content-type application/javascript cache-control max-age=900, public, must-revalidate x-amz-cf-pop FRA2-C1 accept-ranges bytes x-amz-cf-id VQpPGPg7X_ueOV9cPrtBUVZB_GS5QinhDncpaqSulqV7GxW2g99agQ== x-cache-hits 1
GET H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/1/	49 B 725 B	168ms 146ms	Script text/javascript	162.247.243.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=745&ck=1&ref=https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/&ap=274&be=593&fe=692&dc=635&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1637589702347,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:16,%22c%22:16,%22s%22:16,%22ce%22:31,%22rq%22:31,%22rp%22:565,%22rpe%22:575,%22dl%22:571,%22di%22:635,%22ds%22:635,%22de%22:636,%22dc%22:692,%22l%22:692,%22le%22:693%7D,%22navigation%22:%7B%7D%7D&fp=686&fcp=686&at=GkEWQAhCSx5HAxIDThwe&jsonp=NREUM.setToken Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:43 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 6b22b0fc7d306925-FRA
GET H2	200	urs.js Show response urs.zdnet.com/sdk/	50 KB 50 KB	159ms 123ms	Script application/javascript	34.120.203.121 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://urs.zdnet.com/sdk/urs.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.203.121 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 121.203.120.34.bc.googleusercontent.com Software / Resource Hash fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 google last-modified Tue, 12 Jan 2021 17:00:48 GMT etag "5ffdd5c0-c803" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes alt-svc clear content-length 51203
GET H2	200	mpulse-1.0.2.js Show response www.zdnet.com/a/fly/js/libs/	61 KB 12 KB	35ms 35ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/mpulse-1.0.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 12449 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:24 GMT server ContentServer x-frame-options SAMEORIGIN etag "3ef64fab4ee3262b37fedd4dd29ac50b" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:20:54 GMT
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.20.0/	376 KB 84 KB	25ms 24ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jOOTzA5W9ewbfwCUPpt/mw== age 2987652 vary Accept-Encoding content-length 86053 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:48 GMT server cloudflare etag 0x8D941124BEC2620 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id b5562596-701e-0174-096c-c418f5000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6b22b0fc9ab2694c-FRA
OPTIONS H2	200	diff at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ Frame	0 0	141ms 127ms	Preflight text/html	151.101.2.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context a3d3c0e1a3a6184d818b7fe092513fde server Google Frontend accept-ranges bytes date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish x-served-by cache-fra19168-FRA x-cache MISS x-cache-hits 0 x-timer S1637589703.223297,VS0,VE120 vary Accept-Encoding, Origin content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/	155 KB 31 KB	36ms 13ms	Script text/javascript	151.101.65.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.65.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash dba90db52a277e263035c8dadcc63053a5d39006c24e13c67d20f22d46794c3d Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:43 GMT Content-Encoding gzip Age 1308 X-Cache HIT Connection keep-alive Content-Length 31531 x-amz-id-2 ojvrVRLyZVECDvRZ0UfAw6lFgGUMjTM31P6dAs0B+m8OxwwICB5WYoIgaDx8NX6Y/AmMbCBHwUk= X-Served-By cache-fra19163-FRA Last-Modified Mon, 22 Nov 2021 12:46:20 GMT Server AmazonS3 X-Timer S1637589703.208053,VS0,VE0 ETag "a99719e5fda1a9b71a2748173cf35bf3" x-amz-request-id T7GQK7K7B52DRZX7 Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 27
GET H2	200	diff Show response at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/	25 KB 3 KB	141ms 141ms	Fetch application/json	151.101.2.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash 451b65c3e2b0ec7b9220d3f4ce562519c3523cbe7146aefefd56c785d511a071 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers cat 5zTciER5s Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type application/json Accept application/json Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ variant core version rv2.25.6 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff age 0 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 2640 x-xss-protection 1; mode=block x-served-by cache-fra19168-FRA access-control-allow-origin * server Google Frontend x-timer S1637589703.349984,VS0,VE134 x-frame-options SAMEORIGIN date Mon, 22 Nov 2021 14:01:43 GMT x-download-options noopen vary Accept-Encoding, Origin content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context 9db6be3480dd71d697219c203d26120a cache-control max-age=900 etag W/e81251357a234eca7df0073c0286dac90094da02 accept-ranges bytes access-control-allow-headers * x-cache-hits 1
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	77 KB 27 KB	40ms 15ms	Script text/javascript	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software sffe / Resource Hash e0d71e9e83d526a320cdee881361d1abcf386a92a21c116a31976690453bc75c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1051 / 490 of 1000 / last-modified: 1637582729" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 26883 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 22 Nov 2021 14:01:43 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/v2/	2 KB 1 KB	36ms 36ms	XHR application/json	2a02:26f0:6c00:1bb::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1637589703226&s=3b5946290971c08a7cab7f64239fb6b523c0b91e219da193be27d9dacf990699 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash b707696c84b7fa687784046795360f347e2fb6a163f5c0c0d70b998ce71ab9fc Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:43 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 881
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/	93 KB 20 KB	24ms 23ms	Fetch application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/en.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 AlmWtxV11YCExQkuyz0PJA== age 14059 vary Accept-Encoding content-length 20136 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:59 GMT server cloudflare etag 0x8D942234AE979B3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 04e26c27-701e-00bc-7615-b6cf97000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6b22b0fd3f2c4e6d-FRA expires Mon, 22 Nov 2021 18:01:43 GMT
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gptprebidnative/202111171629/	189 KB 60 KB	7ms 7ms	Script application/javascript	151.101.65.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202111171629/wrap.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.65.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 2c125e6a12e3dd1d1d1aec93292e90fb3c28f36646a954402702b1d9c25175b1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:43 GMT Content-Encoding gzip Age 270 X-Cache HIT Connection keep-alive Content-Length 61293 x-amz-id-2 jzXf5usRbJR3PYvp69Big/B/XsVaN007aaf8DzTo4oE6Ozrfyzq3/rqhk6J2PTv5JM4jjOX3BWs= X-Served-By cache-fra19163-FRA Last-Modified Wed, 17 Nov 2021 21:29:49 GMT Server AmazonS3 X-Timer S1637589703.241916,VS0,VE0 ETag "cb7589d017ac65aecf6dc6f5ec17c4b7" x-amz-request-id KY5DB13GGJV0P5XQ Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 173
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.20.0/assets/	13 KB 3 KB	13ms 13ms	Fetch application/json	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/assets/otFlat.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OL7qnwFOarng5AW29V9Pw== age 2987627 vary Accept-Encoding content-length 2950 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:42 GMT server cloudflare etag 0x8D94112485FC2D3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 84c52ef2-f01e-0048-626c-c4ea7b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6b22b0fd8fe04e6d-FRA
GET H2	200	pubads_impl_2021111601.js Show response securepubads.g.doubleclick.net/gpt/	344 KB 116 KB	15ms 14ms	Script text/javascript	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software sffe / Resource Hash 3eee78aaf4f9dc8d0d36d3dddbaad9094ace5d91611f9aee6fe0b44b0ed46ccc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 118471 x-xss-protection 0 last-modified Tue, 16 Nov 2021 09:34:07 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 22 Nov 2021 14:01:43 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	217 B 153 B	30ms 16ms	XHR application/json	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash 12717f96c61a500136a8564d666db9b960869a71dd3176a438b53fb08be5c7bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 128 x-xss-protection 0 expires Mon, 22 Nov 2021 14:01:43 GMT
GET H2	200	article-86184d81e5-rev.js Show response www.zdnet.com/a/fly/js/pages/	104 KB 27 KB	7ms 6ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/pages/article-86184d81e5-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 364e9fa8e5ebd2723bceb6ad16241c713dbf20df34f4694041995de5b499eca3 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 27159 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:31 GMT server ContentServer x-frame-options SAMEORIGIN etag "d83ce306b2d9fdf140a03caaa512ae6c" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:20:55 GMT
POST H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/events/1/	24 B 501 B	607ms 607ms	XHR image/gif	162.247.243.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=993&ck=1&ref=https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 content-type text/plain Response headers Date Mon, 22 Nov 2021 14:01:43 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com access-control-allow-credentials true Connection keep-alive CF-Ray 6b22b0fde8bc6925-FRA Content-Length 24
GET H2	200	cohesion-latest.min.js Show response cdn.cohesionapps.com/cohesion/	77 KB 21 KB	271ms 7ms	Script text/javascript	65.9.71.18 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/cohesion-latest.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.71.18 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-71-18.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash 15fc6da0c56525b38a69504e4d5e73d1126290aff814150c4468d303a73bc727 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-amz-version-id null content-encoding gzip etag W/"237f1a86ca36f84a0eb06096a5a162f7" last-modified Thu, 18 Nov 2021 13:26:43 GMT server AmazonS3 age 2093 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript via 1.1 6b38a2e1db230db568190464ab7177db.cloudfront.net (CloudFront) date Mon, 22 Nov 2021 13:26:52 GMT x-amz-cf-pop FRA56-C1 x-amz-cf-id KLwFOGfTbrt6tZzYZojzDTsMhgCXkkkoFljSQxvSBIxgKDo0C0FAhQ==
GET H2	200	/ Show response www.zdnet.com/components/breaking-news/xhr/	1 KB 1 KB	120ms 120ms	XHR application/json	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9f682d22d4af295f13735efdb26af3b5f106a580f65d6863739872b4dad7bbee Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-301ecb98e12c5885----1637589703433 traceparent 00-35da9d27212e9f4c20115d50226cda50-301ecb98e12c5885-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiMzAxZWNiOThlMTJjNTg4NSIsInRyIjoiMzVkYTlkMjcyMTJlOWY0YzIwMTE1ZDUwMjI2Y2RhNTAiLCJ0aSI6MTYzNzU4OTcwMzQzMywidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff last-modified Mon, 22 Nov 2021 14:01:15 GMT vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFtcXRQODFJfQzkGQ1NSCQ8NBW8MXRVLGhgCHVUJUQFRH1JKBgNTXlUUHgFIQ1oPUFQDUQBSBgACUAcCAwhAFF5VXkAAZA== x-frame-options SAMEORIGIN date Mon, 22 Nov 2021 14:01:43 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 069c5c7d-e3d8-4d76-b103-59032e852f5a content-type application/json via 1.1 varnish cache-control max-age=5400, private accept-ranges bytes expires Mon, 22 Nov 2021 15:31:15 GMT
GET H2	200	track-cwv-72dfb3ae38-rev.js Show response www.zdnet.com/a/fly/js/components/	239 B 313 B	6ms 6ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/track-cwv-72dfb3ae38-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 9b7909cb9edd007095b41a13617b66208e4210fff9c5e411a7db116efefc8e71 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 199 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:30 GMT server ContentServer x-frame-options SAMEORIGIN etag "97dcb9aecd7642860f6ba848435a0178" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:21:00 GMT
GET H2	200	my-finance-widget-068f12d78c-rev.js Show response www.zdnet.com/a/fly/js/components/	1 KB 712 B	7ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/my-finance-widget-068f12d78c-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 758c7d9d726719d14444ed93bfb64d21c84342d6ca479826b1477d7da24b3a14 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 553 x-xss-protection 1; mode=block last-modified Mon, 22 Nov 2021 10:11:25 GMT server ContentServer x-frame-options SAMEORIGIN etag "9b230c03eb3701540a98b0653e3dd4f1" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 29 Nov 2021 10:13:15 GMT
GET H2	200	disqus-loader-891338aca1-rev.js Show response www.zdnet.com/a/fly/js/components/	1 KB 797 B	7ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/disqus-loader-891338aca1-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bb852945d8e9ae2dddadccfbce542830d5e86adf940a29239fa2742d6e79e2fb Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 685 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:30 GMT server ContentServer x-frame-options SAMEORIGIN etag "e86548f942d1e287f61cc7f47d86c9f0" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:20:55 GMT
GET H2	200	front-door-carousel-dcdcc78ebc-rev.js Show response www.zdnet.com/a/fly/js/components/	5 KB 2 KB	7ms 6ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0f23aaa9d0fec5942a9907b88ad801ff3eff3abede69bf286d869061201c67fe Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 1651 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:31 GMT server ContentServer x-frame-options SAMEORIGIN etag "dc62c0d907dc1b97c293d3b1d74c0cbd" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:20:55 GMT
GET H2	200	istock-1073181480.jpg www.zdnet.com/a/img/resize/6f1b7da828dab9091717bb512b1070b7e501f885/2021/01/27/1957b2fc-4610-4fad-81a3-6e835b898ead/	2 KB 3 KB	8ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/6f1b7da828dab9091717bb512b1070b7e501f885/2021/01/27/1957b2fc-4610-4fad-81a3-6e835b898ead/istock-1073181480.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 979dde8d20e8048212a217520411ae6377d2255b0cb41e11c60fa5fd6474cda6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=62713 idim=1366x768 ifmt=jpeg ofsz=2424 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2424 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Ux43tYJ/P8N1CBEsfw3+oDK8xJ2yvDrdNTxiLOs09lc" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 22 Nov 2021 14:09:31 GMT
GET H2	200	a-woman-using-a-laptop-for-online-shopping.jpg www.zdnet.com/a/img/resize/3489185cbdb0873f88a81d466a3632e73846bd5e/2021/11/22/dd381fa7-ac7c-4850-8fd8-8d4acb751588/	6 KB 6 KB	9ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/3489185cbdb0873f88a81d466a3632e73846bd5e/2021/11/22/dd381fa7-ac7c-4850-8fd8-8d4acb751588/a-woman-using-a-laptop-for-online-shopping.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 9ca9ba3b20e337234cdbdb4336b9a71d534b2b566bb5eda09f7242c8ca976128 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1578744 idim=2121x1414 ifmt=jpeg ofsz=6070 odim=170x128 ofmt=webp fastly-stats io=1 content-length 6070 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "mZzZIyn5tzKd1sfhowz1Ib9Qk4WADjltCaxDW9LfNEg" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 22 Nov 2021 13:11:07 GMT
GET H2	200	cash-management.jpg www.zdnet.com/a/img/resize/b799722f64b464b10a5e5bb8fe791c3e2626cd05/2021/09/29/e90bef5c-f13d-491d-923d-45f586e372e3/	5 KB 6 KB	9ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/b799722f64b464b10a5e5bb8fe791c3e2626cd05/2021/09/29/e90bef5c-f13d-491d-923d-45f586e372e3/cash-management.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2b1bff82bd5ad438c1641b4c1100dacfaf4030a218b97bdcc6ce1d2352b291bc Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1694758 idim=1600x1069 ifmt=jpeg ofsz=5406 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5406 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "RF6viThsqFg8cf2slHl23sTfFJN7jEYJjlcYFwXMGrg" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 22 Nov 2021 05:58:35 GMT
GET H2	200	customer-payment-eftpos-lghero.jpg www.zdnet.com/a/img/resize/7068c27930545dbbcb7e22aaa7d13db837d90118/2021/08/04/77a2b619-3d0f-450d-b5a9-f5d44a62aff2/	3 KB 3 KB	9ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/7068c27930545dbbcb7e22aaa7d13db837d90118/2021/08/04/77a2b619-3d0f-450d-b5a9-f5d44a62aff2/customer-payment-eftpos-lghero.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2bb72d904370015a4720bdaeb52673d1dce4ba1e583be96bb806f8ff33fb8587 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=147025 idim=1180x1240 ifmt=jpeg ofsz=2790 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2790 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Liudv3fJ9s2fEx3h1RoaeiPfZ7QCjAdS46BsLu613UM" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 21 Nov 2021 21:00:31 GMT
GET H2	200	sale-306731-article-image.jpg www.zdnet.com/a/img/resize/364f928c8141fcc80dd69cf42afb955f4d58a24c/2021/11/19/c4a98b74-ee76-48aa-8837-b8edbb9081fd/	4 KB 4 KB	7ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/364f928c8141fcc80dd69cf42afb955f4d58a24c/2021/11/19/c4a98b74-ee76-48aa-8837-b8edbb9081fd/sale-306731-article-image.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f1ac8e7cbce7e287125e8e43fcd39204abaf686c911446ee47f069d351076dc7 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=206653 idim=1200x800 ifmt=jpeg ofsz=4234 odim=170x128 ofmt=webp fastly-stats io=1 content-length 4234 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "D0MnluWCxqDz7YKGqv88x5kkwpEMLA+H9Zfhm7Mr9JQ" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 21 Nov 2021 15:00:21 GMT
GET H2	200	shutterstock-1691211286.jpg www.zdnet.com/a/img/resize/db476841c29a26d8a63a7f909c4ca99ef21aaff6/2021/11/19/5c020588-4a2f-4325-9dd6-0e8a90363b2e/	5 KB 6 KB	9ms 8ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/db476841c29a26d8a63a7f909c4ca99ef21aaff6/2021/11/19/5c020588-4a2f-4325-9dd6-0e8a90363b2e/shutterstock-1691211286.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bf23ab83dc6eeadd70e43f707b8e3f061d4b0b3dacf651b96bc393d6ba0d83a2 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=2857826 idim=6016x4016 ifmt=jpeg ofsz=5526 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5526 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "V+3DInmVXyFyHPxqwhUHgjUp91Tp2nIZRwZn6PQvKOo" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 19 Nov 2021 13:30:03 GMT
GET H2	200	shutterstock-2032695119.jpg www.zdnet.com/a/img/resize/9426d190c2bf1e514fda75aed51c9bc3f306c3ab/2021/10/15/3eab866d-2d38-4d61-a69c-c255bd7bd477/	5 KB 5 KB	11ms 10ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/9426d190c2bf1e514fda75aed51c9bc3f306c3ab/2021/10/15/3eab866d-2d38-4d61-a69c-c255bd7bd477/shutterstock-2032695119.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b76efb6be235efeb5a082cf206c18fb1761abae1fe72bb2c19907238fd548156 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=19686151 idim=7952x5304 ifmt=jpeg ofsz=4626 odim=170x128 ofmt=webp fastly-stats io=1 content-length 4626 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "qRkwxThDTi+J3RhiJrFtU7ch87FFIVuSx/VHughRXd0" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Tue, 16 Nov 2021 19:22:00 GMT
GET H2	200	shutterstock-1619862829.jpg www.zdnet.com/a/img/resize/ce2e23bf642d1f8e1d2e05821337d8945f29f3eb/2021/11/19/d304247f-2b3d-4c25-8b8c-bcbc70746371/	4 KB 4 KB	9ms 8ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/ce2e23bf642d1f8e1d2e05821337d8945f29f3eb/2021/11/19/d304247f-2b3d-4c25-8b8c-bcbc70746371/shutterstock-1619862829.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 4dd36bede4eb92677e5aae5435b3747c1b1e66a0bb52d8388db1aa075acb2ab4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=15539974 idim=6325x4217 ifmt=jpeg ofsz=3848 odim=170x128 ofmt=webp fastly-stats io=1 content-length 3848 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "3naMrzDq+JqhL8Kl9WNT3n2T7ilFf6wAqjJ63ohZiBA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 19 Nov 2021 12:04:56 GMT
GET H2	200	tech-earnings.png www.zdnet.com/a/img/resize/eb0ca8cbd0ad096b65c884aead5219f8e0f28c27/2021/11/19/2ecb04d3-1eb5-4de2-983e-d341515066e3/	23 KB 24 KB	9ms 9ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/eb0ca8cbd0ad096b65c884aead5219f8e0f28c27/2021/11/19/2ecb04d3-1eb5-4de2-983e-d341515066e3/tech-earnings.png?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b493275f387291f670a8cc70e093c30c96c23f407b1e3a556dea3254f15962e2 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1039298 idim=1600x1069 ifmt=png ofsz=23886 odim=170x128 ofmt=webp fastly-stats io=1 content-length 23886 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "qSQmXdisel6A3jYxW1WB9KYRCdSVB6tehqkndZkaD00" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 19 Nov 2021 13:36:55 GMT
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 1 KB	179ms 178ms	XHR application/json	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2195cd11eb5a88f8328d14e37376444088ec93043bfb523aaa73d2f2fc6b9aac Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-5db9ea8701283be1----1637589703445 traceparent 00-76af9aa78981a7ea47fa1e2e4034b050-5db9ea8701283be1-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiNWRiOWVhODcwMTI4M2JlMSIsInRyIjoiNzZhZjlhYTc4OTgxYTdlYTQ3ZmExZTJlNDAzNGIwNTAiLCJ0aSI6MTYzNzU4OTcwMzQ0NSwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFZWRxcNB0NFUhQ7Rl9XBQMXPUMKVxVnVFtVWgsbTQFPA1JUBgdNVk0IBwFSWU4aABtEVgQABAYEUwcAWgkGXAgDBRFJXwBdElY/ x-frame-options SAMEORIGIN date Mon, 22 Nov 2021 14:01:43 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 46d07962-3db5-4fc1-a4e4-28d9ef875402 content-type application/json via 1.1 varnish cache-control max-age=0, must-revalidate, private accept-ranges bytes expires Mon, 22 Nov 2021 14:01:43 GMT
GET H2	200	istock-1073181480.jpg www.zdnet.com/a/img/resize/6f1b7da828dab9091717bb512b1070b7e501f885/2021/01/27/1957b2fc-4610-4fad-81a3-6e835b898ead/	2 KB 3 KB	8ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/6f1b7da828dab9091717bb512b1070b7e501f885/2021/01/27/1957b2fc-4610-4fad-81a3-6e835b898ead/istock-1073181480.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 979dde8d20e8048212a217520411ae6377d2255b0cb41e11c60fa5fd6474cda6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=62713 idim=1366x768 ifmt=jpeg ofsz=2424 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2424 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Ux43tYJ/P8N1CBEsfw3+oDK8xJ2yvDrdNTxiLOs09lc" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 22 Nov 2021 14:09:31 GMT
GET H2	200	sale-306731-article-image.jpg www.zdnet.com/a/img/resize/364f928c8141fcc80dd69cf42afb955f4d58a24c/2021/11/19/c4a98b74-ee76-48aa-8837-b8edbb9081fd/	4 KB 4 KB	6ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/364f928c8141fcc80dd69cf42afb955f4d58a24c/2021/11/19/c4a98b74-ee76-48aa-8837-b8edbb9081fd/sale-306731-article-image.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f1ac8e7cbce7e287125e8e43fcd39204abaf686c911446ee47f069d351076dc7 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=206653 idim=1200x800 ifmt=jpeg ofsz=4234 odim=170x128 ofmt=webp fastly-stats io=1 content-length 4234 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "D0MnluWCxqDz7YKGqv88x5kkwpEMLA+H9Zfhm7Mr9JQ" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 21 Nov 2021 15:00:21 GMT
GET H2	200	a-woman-using-a-laptop-for-online-shopping.jpg www.zdnet.com/a/img/resize/3489185cbdb0873f88a81d466a3632e73846bd5e/2021/11/22/dd381fa7-ac7c-4850-8fd8-8d4acb751588/	6 KB 6 KB	6ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/3489185cbdb0873f88a81d466a3632e73846bd5e/2021/11/22/dd381fa7-ac7c-4850-8fd8-8d4acb751588/a-woman-using-a-laptop-for-online-shopping.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 9ca9ba3b20e337234cdbdb4336b9a71d534b2b566bb5eda09f7242c8ca976128 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1578744 idim=2121x1414 ifmt=jpeg ofsz=6070 odim=170x128 ofmt=webp fastly-stats io=1 content-length 6070 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "mZzZIyn5tzKd1sfhowz1Ib9Qk4WADjltCaxDW9LfNEg" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 22 Nov 2021 13:11:07 GMT
GET H2	200	cash-management.jpg www.zdnet.com/a/img/resize/b799722f64b464b10a5e5bb8fe791c3e2626cd05/2021/09/29/e90bef5c-f13d-491d-923d-45f586e372e3/	5 KB 5 KB	6ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/b799722f64b464b10a5e5bb8fe791c3e2626cd05/2021/09/29/e90bef5c-f13d-491d-923d-45f586e372e3/cash-management.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2b1bff82bd5ad438c1641b4c1100dacfaf4030a218b97bdcc6ce1d2352b291bc Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1694758 idim=1600x1069 ifmt=jpeg ofsz=5406 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5406 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "RF6viThsqFg8cf2slHl23sTfFJN7jEYJjlcYFwXMGrg" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 22 Nov 2021 05:58:35 GMT
GET H2	200	customer-payment-eftpos-lghero.jpg www.zdnet.com/a/img/resize/7068c27930545dbbcb7e22aaa7d13db837d90118/2021/08/04/77a2b619-3d0f-450d-b5a9-f5d44a62aff2/	3 KB 3 KB	6ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/7068c27930545dbbcb7e22aaa7d13db837d90118/2021/08/04/77a2b619-3d0f-450d-b5a9-f5d44a62aff2/customer-payment-eftpos-lghero.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2bb72d904370015a4720bdaeb52673d1dce4ba1e583be96bb806f8ff33fb8587 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=147025 idim=1180x1240 ifmt=jpeg ofsz=2790 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2790 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Liudv3fJ9s2fEx3h1RoaeiPfZ7QCjAdS46BsLu613UM" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 21 Nov 2021 21:00:31 GMT
GET H2	200	shutterstock-1691211286.jpg www.zdnet.com/a/img/resize/db476841c29a26d8a63a7f909c4ca99ef21aaff6/2021/11/19/5c020588-4a2f-4325-9dd6-0e8a90363b2e/	5 KB 6 KB	6ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/db476841c29a26d8a63a7f909c4ca99ef21aaff6/2021/11/19/5c020588-4a2f-4325-9dd6-0e8a90363b2e/shutterstock-1691211286.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bf23ab83dc6eeadd70e43f707b8e3f061d4b0b3dacf651b96bc393d6ba0d83a2 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=2857826 idim=6016x4016 ifmt=jpeg ofsz=5526 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5526 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "V+3DInmVXyFyHPxqwhUHgjUp91Tp2nIZRwZn6PQvKOo" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 19 Nov 2021 13:30:03 GMT
GET H2	200	shutterstock-1619862829.jpg www.zdnet.com/a/img/resize/ce2e23bf642d1f8e1d2e05821337d8945f29f3eb/2021/11/19/d304247f-2b3d-4c25-8b8c-bcbc70746371/	4 KB 4 KB	7ms 6ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/ce2e23bf642d1f8e1d2e05821337d8945f29f3eb/2021/11/19/d304247f-2b3d-4c25-8b8c-bcbc70746371/shutterstock-1619862829.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 4dd36bede4eb92677e5aae5435b3747c1b1e66a0bb52d8388db1aa075acb2ab4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=15539974 idim=6325x4217 ifmt=jpeg ofsz=3848 odim=170x128 ofmt=webp fastly-stats io=1 content-length 3848 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "3naMrzDq+JqhL8Kl9WNT3n2T7ilFf6wAqjJ63ohZiBA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 19 Nov 2021 12:04:56 GMT
GET H2	200	tech-earnings.png www.zdnet.com/a/img/resize/eb0ca8cbd0ad096b65c884aead5219f8e0f28c27/2021/11/19/2ecb04d3-1eb5-4de2-983e-d341515066e3/	23 KB 23 KB	7ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/eb0ca8cbd0ad096b65c884aead5219f8e0f28c27/2021/11/19/2ecb04d3-1eb5-4de2-983e-d341515066e3/tech-earnings.png?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b493275f387291f670a8cc70e093c30c96c23f407b1e3a556dea3254f15962e2 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1039298 idim=1600x1069 ifmt=png ofsz=23886 odim=170x128 ofmt=webp fastly-stats io=1 content-length 23886 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "qSQmXdisel6A3jYxW1WB9KYRCdSVB6tehqkndZkaD00" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 19 Nov 2021 13:36:55 GMT
GET H2	200	shutterstock-2032695119.jpg www.zdnet.com/a/img/resize/9426d190c2bf1e514fda75aed51c9bc3f306c3ab/2021/10/15/3eab866d-2d38-4d61-a69c-c255bd7bd477/	5 KB 5 KB	7ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/9426d190c2bf1e514fda75aed51c9bc3f306c3ab/2021/10/15/3eab866d-2d38-4d61-a69c-c255bd7bd477/shutterstock-2032695119.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/141b7a-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b76efb6be235efeb5a082cf206c18fb1761abae1fe72bb2c19907238fd548156 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=19686151 idim=7952x5304 ifmt=jpeg ofsz=4626 odim=170x128 ofmt=webp fastly-stats io=1 content-length 4626 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "qRkwxThDTi+J3RhiJrFtU7ch87FFIVuSx/VHughRXd0" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Tue, 16 Nov 2021 19:22:00 GMT
GET H2	200	moatheader.js Show response z.moatads.com/redventuresgamheader644747280705/	240 KB 82 KB	48ms 8ms	Script application/x-javascript	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 660c4944d12218cf2b184d845516f3930ba222de846078099256b70ea7acaf90 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip last-modified Thu, 18 Nov 2021 20:54:15 GMT server AmazonS3 x-amz-request-id 1RRSBZY4W7RA780S etag "d267327ac3a2238138aff00eeb7a88f1" vary Accept-Encoding content-type application/x-javascript cache-control max-age=35649 accept-ranges bytes content-length 83685 x-amz-id-2 IwXDqdN+AxPj+o3J+eOIDBuX6Ef/w+uZkQTsfBVqvX0LQY+5Lk/1S56dTfiQ0tjaiSIt9J3TMUU=
GET H2	200	integrator.js Show response adservice.google.de/adsid/	107 B 792 B	41ms 16ms	Script application/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 549 B	40ms 15ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	16 KB 9 KB	407ms 406ms	XHR text/plain	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4417576961676516&correlator=2752595122115836&output=ldjh&impl=fifs&eid=44748553&vrg=2021111601&ptt=17&sc=1&sfv=1-0-38&ecs=20211122&iu_parts=22309610186%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x66%7C5x5&prev_scp=pos%3Dnav%26sl%3Dnav-ad-plus-leader%253FT-1000%26iid%3Dunit%253Dnav-ad-plus-leader%257Cvguid%253D8bfe1ebc-537a-4bb6-88e8-be74c14df28e%257Cpv%253D1&eri=1&cust_params=test%3Drelated_rr%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cbanking%252Candroid%26mfr%3Dgoogle%252Cats-communications%26tag%3Dmalware%252Cbanking%252Ccyber-security%26prodtype%3Dandroid%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dnew-banking-trojan-sharkbot-makes-waves-across-europe%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D2%26session%3Db%26pv%3D1%26vguid%3D8bfe1ebc-537a-4bb6-88e8-be74c14df28e&cookie_enabled=1&bc=31&abxe=1&lmt=1637589703&dt=1637589703643&dlt=1637589702918&idt=481&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=50&adks=3846852823&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100&msz=1600x100&ga_vid=2002660727.1637589704&ga_sid=1637589704&ga_hid=2009357019&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash a0b9526f8388964e15e0faebd066a5a6c8183915c1dc65d5cf5df2f59dc08b4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8705 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	12 KB 9 KB	44ms 21ms	XHR application/json	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021111601&st=env Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 34c6dcfaf31ba4ae02848ffa9a79e621f6f23e1e97804627e46e133ce77dee17 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9260 x-xss-protection 0
GET H2	200	container.html Show response e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BEF5	6 KB 4 KB	54ms 15ms	Document text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 22 Nov 2021 14:01:43 GMT expires Tue, 22 Nov 2022 14:01:43 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	12 KB 7 KB	478ms 477ms	XHR text/plain	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4417576961676516&correlator=3704822555977828&output=ldjh&impl=fifs&eid=44748553&vrg=2021111601&ptt=17&sc=1&sfv=1-0-38&ecs=20211122&iu_parts=22309610186%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Dtop%26sl%3Dmpu-plus-top%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-plus-top%257Cvguid%253D8bfe1ebc-537a-4bb6-88e8-be74c14df28e%257Cpv%253D1&eri=1&cust_params=test%3Drelated_rr%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cbanking%252Candroid%26mfr%3Dgoogle%252Cats-communications%26tag%3Dmalware%252Cbanking%252Ccyber-security%26prodtype%3Dandroid%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dnew-banking-trojan-sharkbot-makes-waves-across-europe%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D2%26session%3Db%26pv%3D1%26vguid%3D8bfe1ebc-537a-4bb6-88e8-be74c14df28e&cookie_enabled=1&bc=31&abxe=1&lmt=1637589703&dt=1637589703682&dlt=1637589702918&idt=481&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=421&adks=36326968&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x280&msz=370x30&ga_vid=2002660727.1637589704&ga_sid=1637589704&ga_hid=2009357019&ga_fc=false&fws=4&ohw=370&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash d2be38758246fb2b81df2bf489a7cae6c1a62463ced758f4ba74e9e286878209 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7382 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	24 KB 10 KB	140ms 139ms	XHR text/plain	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4417576961676516&correlator=1323986700921947&output=ldjh&impl=fifs&eid=44748553&vrg=2021111601&ptt=17&sc=1&sfv=1-0-38&ecs=20211122&iu_parts=22309610186%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C11x11&fluid=height&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FLL%257CT-1000%26iid%3Dunit%253Dsharethrough-top%257Cvguid%253D8bfe1ebc-537a-4bb6-88e8-be74c14df28e%257Cpv%253D1&eri=1&cust_params=test%3Drelated_rr%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cbanking%252Candroid%26mfr%3Dgoogle%252Cats-communications%26tag%3Dmalware%252Cbanking%252Ccyber-security%26prodtype%3Dandroid%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dnew-banking-trojan-sharkbot-makes-waves-across-europe%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D2%26session%3Db%26pv%3D1%26vguid%3D8bfe1ebc-537a-4bb6-88e8-be74c14df28e&cookie_enabled=1&bc=31&abxe=1&lmt=1637589703&dt=1637589703685&dlt=1637589702918&idt=481&frm=20&biw=1600&bih=1200&oid=2&adxs=215&adys=1284&adks=697432828&ucis=3&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x150&msz=770x0&ga_vid=2002660727.1637589704&ga_sid=1637589704&ga_hid=2009357019&ga_fc=false&fws=4&ohw=770&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash d81fe13a24f0486d5876a22b9b0c1b57372ab6c82c34657ca5f00276ac22aed4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10052 x-xss-protection 0 google-lineitem-id 5823350303 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138371350639 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	12 KB 7 KB	398ms 398ms	XHR text/plain	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4417576961676516&correlator=3720410349974436&output=ldjh&impl=fifs&eid=44748553&vrg=2021111601&ptt=17&sc=1&sfv=1-0-38&ecs=20211122&iu_parts=22309610186%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&prev_scp=pos%3Dmiddle%26sl%3Dmpu-middle%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-middle%257Cvguid%253D8bfe1ebc-537a-4bb6-88e8-be74c14df28e%257Cpv%253D1&eri=1&cust_params=test%3Drelated_rr%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cbanking%252Candroid%26mfr%3Dgoogle%252Cats-communications%26tag%3Dmalware%252Cbanking%252Ccyber-security%26prodtype%3Dandroid%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dnew-banking-trojan-sharkbot-makes-waves-across-europe%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D2%26session%3Db%26pv%3D1%26vguid%3D8bfe1ebc-537a-4bb6-88e8-be74c14df28e&cookie_enabled=1&bc=31&abxe=1&lmt=1637589703&dt=1637589703687&dlt=1637589702918&idt=481&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=1304&adks=2638305364&ucis=4&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x30&msz=370x30&ga_vid=2002660727.1637589704&ga_sid=1637589704&ga_hid=2009357019&ga_fc=false&fws=4&ohw=370&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash 4faeb9ea3975ca41e21765901bd6ef9c6f62284ad3e0049e5b690600112f08ea Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7363 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	43ms 21ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Mon, 22 Nov 2021 14:01:43 GMT
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	344ms 112ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	339ms 112ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	338ms 112ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	337ms 112ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	134ms 133ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash fab8f355626bc7db7a32dc220b0f6b2cd1aa09f4a82833305e8e8035185acf9c Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	124ms 122ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash 8a27643d637a9d53a3250e2717c920ec325583febd2f67cfdba7ae4f8d6ce841 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	129ms 128ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash 44f066a31b00055954e0e5a775285354e6653603986b2dd3e801b0aff05d279c Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	134ms 132ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash a94ea10c1de1b50f2b28f3779d599dbe0583421d37dda3b42a519f6e0c384647 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
GET H2	200	xs1.html Show response cdn.cohesionapps.com/cohesion/ Frame E4A6	2 KB 1 KB	8ms 7ms	Document text/html	65.9.71.18 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs1.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.71.18 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-71-18.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash afac3a301d848688d0748228296ec7ae26369f67c2df29f3f480ef3ab0bc6ef9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers content-type text/html last-modified Thu, 18 Nov 2021 13:26:43 GMT x-amz-server-side-encryption AES256 x-amz-version-id null server AmazonS3 content-encoding gzip date Mon, 22 Nov 2021 03:19:14 GMT etag W/"10b2c1751c2247b1aeccc91060f971cf" vary Accept-Encoding x-cache Hit from cloudfront via 1.1 6b38a2e1db230db568190464ab7177db.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C1 x-amz-cf-id cCX1TK_5IXr9MWRTbMxaVg6VdVB-Gxuug9OG_hnm3Ril6L-qtDE9Hg== age 38550
GET H2	200	public Show response taggy.cohesionapps.com/implementations/	8 KB 8 KB	104ms 103ms	XHR application/json	3.214.19.146 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://taggy.cohesionapps.com/implementations/public Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.214.19.146 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-214-19-146.compute-1.amazonaws.com Software / Express Resource Hash 0a830965bf0ca79c75b43b1daac3fd85af97805d62d551b7773792b2a9eac461 Request headers Source-Key src_1kYsAcdpfzbZ8UlNLYht1RPg3m2 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 Page-URL https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT x-powered-by Express etag W/"2036-w2pJk5XK3C/Qt0xt8xobw0SHNLc" content-length 8246 content-type application/json; charset=utf-8
OPTIONS H2	204	public taggy.cohesionapps.com/implementations/ Frame	0 0	329ms 102ms	Preflight	3.214.19.146 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://taggy.cohesionapps.com/implementations/public Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.214.19.146 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-214-19-146.compute-1.amazonaws.com Software / Express Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers content-type,page-url,source-key Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT x-powered-by Express access-control-allow-origin * access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE vary Access-Control-Request-Headers access-control-allow-headers content-type,page-url,source-key
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 1 KB	171ms 170ms	XHR application/json	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 99160fd3f6279c5c2d9906f099f21bf1fd05e965e6dea54812ae92e674c4804d Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-9423c0d12dc45448----1637589703741 traceparent 00-b5680ef9f2a6a345f80be07d5e11ec50-9423c0d12dc45448-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiOTQyM2MwZDEyZGM0NTQ0OCIsInRyIjoiYjU2ODBlZjlmMmE2YTM0NWY4MGJlMDdkNWUxMWVjNTAiLCJ0aSI6MTYzNzU4OTcwMzc0MSwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFZWRxcNB0NFUhQ7Rl9XBQMXPUMKVxVnVFtVWgsbTQFPA1JUBgdNVk0IBwFcU04aABtEV1BTBwAEBlQEUQFaDghVUxFJXwBdElY/ x-frame-options SAMEORIGIN date Mon, 22 Nov 2021 14:01:43 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id c8e45df4-03d1-441b-9730-3c62d76c8195 content-type application/json via 1.1 varnish cache-control max-age=0, must-revalidate, private accept-ranges bytes expires Mon, 22 Nov 2021 14:01:43 GMT
GET H/1.1	204 No Content	/ Show response 0217991d.akstat.io/	0 354 B	52ms 36ms	XHR image/gif	2a02:26f0:6c00:287::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://0217991d.akstat.io/?h.pg=article&h.ab=related_rr_control_1&when=1637589703699&cdim.Site_View=desktop&t_other=custom4%7C571&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=6d46a97f0ccc3eb1018d1d664d82a4fee7276ac7-d759083d-800602a4&h.t=1637589703247&http.initiator=api&rt.start=api&rt.si=550b09de-34b8-4839-9544-e195298d26b7&rt.ss=1637589704105&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:287::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:43 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Mon, 22 Nov 2021 14:01:43 GMT
GET H2	200	core-web-vitals-16efe3ae21-rev.js Show response www.zdnet.com/a/fly/js/managers/	545 B 624 B	7ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/managers/core-web-vitals-16efe3ae21-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 82f947d14a0a198dfe3cec2fde7896f6e332eb798cc193dad8da9ed2225277cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 366 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:31 GMT server ContentServer x-frame-options SAMEORIGIN etag "13ebb91ff9802e3e819eaeb0ade6750d" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:20:55 GMT
GET H2	200	inlineMedia_core.js Show response static.myfinance.com/widget/	184 KB 63 KB	83ms 52ms	Script application/javascript	2606:4700:3037::6815:2b8a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia_core.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2b8a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 829c410a6b21a34e4127e1ae45f244189a83493c13712d9e5d98f1d2dc19c3f7 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1904 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id PPE0TCCX8MS56HQ2 x-amz-id-2 ijmYvxrIQL9dPGG5er9wWMBSTgjdDuWZ1d9ZySmq5ugYeCB1xVv7t7sAfK1LYRkd3ima/wQsaYA= last-modified Tue, 16 Nov 2021 19:32:09 GMT server cloudflare etag W/"72763a8104cb9ae82dfbd403a0e82253" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=378spz13ePoMGZnbaPHq7Dku1gI38VSPqs9%2Bq24OXWEv520FA1YPiu%2Bzd2CyckVuOxniYqNS0JtbtK8TbujL1ZG2ajI4OmGIv6Jzj8KLoOKu0lZklHyp3caeDxju1LV%2FqFQpkaT1bKbfzVY%2BW%2B8RHchpZQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript vary Accept-Encoding cache-control max-age=14400 cf-ray 6b22b100be9b68ef-FRA
GET H2	200	v2 Show response mb.moatads.com/yi/	334 B 509 B	136ms 43ms	Script text/html	52.48.241.99 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&callback=MoatNadoAllJsonpRequest_89169581 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.48.241.99 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-48-241-99.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 206901a4e0c218995efb7ad417a17e49c2430c844dacbb36b373bfd70eb09627 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "612b2df9782624120ecb130f83caea4d5506ff0b" content-length 334 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	98 B 271 B	129ms 39ms	Script text/html	34.246.74.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1637589703774&de=820210712430&m=0&ar=7e5b6a28623-clean&iw=a0d9f77&q=1&cb=0&cu=1637589703774&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A686%3A686%3A693%3A635&jk=-1&jm=-1&fs=195794&na=876003326&cs=0&ord=1637589703774&jv=1948367042&callback=DOMlessLLDcallback_89169581 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.246.74.180 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-246-74-180.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash b646b1ff7cc78ae0bb97c3a25dea4abbe63b12a6715102e34b5f04cc337cd179 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "dcc9083cc4f49c19c792af0a466d3a12c5bc2729" content-length 98 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	99 B 273 B	127ms 38ms	Script text/html	34.246.74.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1637589703774&de=820210712430&m=0&ar=7e5b6a28623-clean&iw=a0d9f77&q=2&cb=0&cu=1637589703774&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A686%3A686%3A693%3A635&jk=-1&jm=-1&fs=195794&na=1812718911&cs=0&callback=MoatDataJsonpRequest_89169581 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.246.74.180 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-246-74-180.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash ba9a8145fcf9523081f04383ba3ea9a0aea14ed39118ad38e8859396e0371b0f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "72198f0715aea09251aa3b0d3b78b38810a98959" content-length 99 content-type text/html; charset=UTF-8
GET H2	200	show-hide-1.0-51cea9ac43-rev.js Show response www.zdnet.com/a/fly/js/components/	2 KB 789 B	11ms 10ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/show-hide-1.0-51cea9ac43-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 671 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:30 GMT server ContentServer x-frame-options SAMEORIGIN etag "057f9856449aeef0449fee372db7b59c" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 18:21:00 GMT
GET H3	200	container.html Show response e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2C26	6 KB 3 KB	22ms 7ms	Document text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 22 Nov 2021 14:01:43 GMT expires Tue, 22 Nov 2022 14:01:43 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	integrator.js Show response adservice.google.de/adsid/	107 B 122 B	33ms 17ms	Script application/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	integrator.js Show response adservice.google.com/adsid/	107 B 122 B	32ms 16ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:43 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	15 KB 9 KB	316ms 315ms	XHR text/plain	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4417576961676516&correlator=2232055204663581&output=ldjh&impl=fifs&eid=44748553&vrg=2021111601&ptt=17&sc=1&sfv=1-0-38&ecs=20211122&iu_parts=22309610186%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&prev_scp=pos%3Dbottom%26sl%3Dmpu-bottom%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-bottom%257Cvguid%253D8bfe1ebc-537a-4bb6-88e8-be74c14df28e%257Cpv%253D1&eri=1&cust_params=test%3Drelated_rr%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cbanking%252Candroid%26mfr%3Dgoogle%252Cats-communications%26tag%3Dmalware%252Cbanking%252Ccyber-security%26prodtype%3Dandroid%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dnew-banking-trojan-sharkbot-makes-waves-across-europe%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D2%26session%3Db%26pv%3D1%26vguid%3D8bfe1ebc-537a-4bb6-88e8-be74c14df28e%26m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting&cookie=ID%3D9ef4dfea914498aa-22878340f2cb00f8%3AT%3D1637589703%3AS%3DALNI_MZgoPKe103dKpWhhgcLmkaGvsbfag&bc=31&abxe=1&lmt=1637589703&dt=1637589703911&dlt=1637589702918&idt=481&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=1470&adks=3625754864&ucis=5&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x250&msz=370x30&psts=AGkb-H-HaOqrCC74glskn1sRDpRBQ52BE6_SuvJLxY2ediEMgyCIOQB7LY5u3dBEetgO4PRCeM5WLM7pzjmWGzqI8Np8ug&ga_vid=2002660727.1637589704&ga_sid=1637589704&ga_hid=2009357019&ga_fc=false&fws=4&ohw=370&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash 93ee37144aea3ce9ec7bf8f250436cab47cb829c73a82abd3f0ff08b936de217 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9179 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/224/ Frame 6D8A	12 KB 5 KB	24ms 8ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5029 date Mon, 22 Nov 2021 12:33:12 GMT expires Tue, 22 Nov 2022 12:33:12 GMT last-modified Wed, 02 Jun 2021 17:09:45 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 5311 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	aframe Show response www.google.com/recaptcha/api2/ Frame 7875	783 B 1 KB	42ms 17ms	Document text/html	2a00:1450:4001:829::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 3cc6fb5f8606b33b64e998a8c1bb4a914ef8469fe1373abad88d3d21f0d169ba Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-53rL8o1rsIdcoprNSUU9sg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Mon, 22 Nov 2021 14:01:43 GMT date Mon, 22 Nov 2021 14:01:43 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-53rL8o1rsIdcoprNSUU9sg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 510 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	xs2.html Show response cdn.cohesionapps.com/cohesion/ Frame E4A6	473 B 835 B	8ms 8ms	Document text/html	65.9.71.18 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs2.html Requested by Host: cdn.cohesionapps.com URL: https://cdn.cohesionapps.com/cohesion/xs1.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.71.18 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-71-18.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash 88b8a3cb9df436d6910440c58428516accee080be4fa556d3cf10ec6905cf1b9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://cdn.cohesionapps.com/cohesion/xs1.html Response headers content-type text/html content-length 473 last-modified Thu, 18 Nov 2021 13:26:43 GMT x-amz-server-side-encryption AES256 x-amz-version-id null accept-ranges bytes server AmazonS3 date Sun, 21 Nov 2021 22:21:40 GMT etag "ffa03bed298484a7755ca23c5431cb28" x-cache Hit from cloudfront via 1.1 6b38a2e1db230db568190464ab7177db.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C1 x-amz-cf-id 9LdPQ5uS5Dgx49UcuEI4L0hcKBUnPHKjeU9DP1BT8wCfY9rdtkto0w== age 56404
OPTIONS H2	204	record a.myfidevs.io/ Frame	0 0	318ms 103ms	Preflight	18.210.165.46 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.210.165.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-210-165-46.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type,x-api-key Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods POST access-control-allow-headers * server Python/3.7 aiohttp/3.7.4.post0
OPTIONS H2	200	v1.5 www.myfinance.com/api/au/ Frame	0 0	606ms 576ms	Preflight text/html	2606:4700:3030::ac43:b431 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvbmV3LWJhbmtpbmctdHJvamFuLXNoYXJrYm90LW1ha2VzLXdhdmVzLWFjcm9zcy1ldXJvcGUv Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-type text/html; charset=utf-8 vary Origin access-control-allow-credentials true access-control-allow-origin https://www.zdnet.com access-control-allow-headers x-requested-with, content-type, accept, origin, authorization, x-csrftoken, x-api-key, Access-Control-Allow-Origin access-control-allow-methods DELETE, GET, OPTIONS, PATCH, POST, PUT access-control-max-age 86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mnf5Efrcg0A3o1hGn86OPFctEd6XO%2BsZ4vfPcbIBmXwxaLxU%2Bh2dNXpJO8s%2BW7PAtGe4eEk7QT4FaOWv0t%2FNhOPuuBj4WoWnkl7nBJCTAqRIPlfH60UZVlpTY1%2Bd97sg8fuBIhnTaTCr4nT1J0FJgA%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15552000 x-content-type-options nosniff server cloudflare cf-ray 6b22b1020ac3d6e1-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H3	200	inlineMedia.css static.myfinance.com/widget/	3 KB 2 KB	30ms 15ms	Stylesheet text/css	2606:4700:3037::6815:2b8a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:2b8a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c50d5d10df377bd960648973b53891bfcaf48f457503eed023ad2c29f28e49b2 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:43 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1677 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id RM9EMK8GHMB7NW7G x-amz-id-2 rO4/tb/v63P6c/qJxa0JBYiRUj2pmFCIHFUoYyKlU+xVn/UKNLDsHpQEB0iQ2jT47cP+krHxRTQ= last-modified Mon, 12 Jul 2021 14:22:18 GMT server cloudflare etag W/"528a38ce39fc58a866c1226253bbb189" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JKagl%2FHANa1oViAwLCwJ9RImcjcaqy9zXoTQwl2KKvN1CENGhqE%2FTEG2Se5TOvJqx2a2L%2BWUhHuYHIgmv6DMSt5zkFMrvzzMiOIewl24qjk6nr3ip88bFgMQhyq7HvFSTU7m3h%2Frp%2B9K%2BeykgKaItpsRUw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css vary Accept-Encoding cache-control max-age=14400 cf-ray 6b22b101e9c905f5-FRA
POST H2	204	record Show response a.myfidevs.io/	0 166 B	134ms 134ms	XHR text/plain	18.210.165.46 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.210.165.46 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-210-165-46.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/json Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 x-api-key yuH27H1QId6afXAojow6Tafi7Vw9v1spaLD5Yznw Content-Type application/json Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-credentials true server Python/3.7 aiohttp/3.7.4.post0 access-control-allow-headers * access-control-allow-methods POST
POST H3	200	v1.5 Show response www.myfinance.com/api/au/	1 KB 1 KB	255ms 243ms	XHR application/json	2606:4700:3030::ac43:b431 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvbmV3LWJhbmtpbmctdHJvamFuLXNoYXJrYm90LW1ha2VzLXdhdmVzLWFjcm9zcy1ldXJvcGUv Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 87c6c35597f704dfb23f2bd4a9b69d69db9744781328bcaa134489bd41eb6ebd Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept application/json Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type application/json Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-type application/json alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 allow POST, GET server cloudflare x-frame-options SAMEORIGIN expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cWkNLGk6voyW6DJfvcah6JENhCUekkfzN9%2BVrZkpG0%2BXY%2BIx1Y%2BJUvyQSvfyn4ID8unNJKUJdCUfkWuTKZf5I4KAGgxGryDM%2FqB4RKavnW2zhdoKSqk8CSLCFuCZPQeW%2F3Nu8XvauVIGHTSvqGx1JQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-language en-us access-control-allow-origin https://www.zdnet.com vary Accept, Accept-Language, Origin, Cookie cache-control max-age=0, no-cache, no-store, must-revalidate access-control-allow-credentials true cf-ray 6b22b105b99d6943-FRA expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	ext.js Show response tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 2C26	22 KB 7 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:48:44 GMT content-encoding gzip x-content-type-options nosniff age 7980 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7022 x-xss-protection 0 last-modified Tue, 02 Mar 2021 20:17:03 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control public, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Tue, 22 Nov 2022 11:48:44 GMT
GET H2	200	css fonts.googleapis.com/ Frame 2C26	4 KB 1 KB	43ms 16ms	Stylesheet text/css	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,700&lang=de Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 22 Nov 2021 13:01:30 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Mon, 22 Nov 2021 14:01:44 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	B26699368.318388975;dc_pre=CLTx44SRrPQCFZpk4AodKx8LBA;dc_trk_aid=510968212;dc_trk_cid=160531770;ord=740876021;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/ Frame 2C26 Redirect Chain https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699368.318388975;dc_trk_aid=510968212;dc_trk_cid=160531770;ord=740876021;dc_lat=;dc_rdid=;tag_for_child_directed_treatmen... https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699368.318388975;dc_pre=CLTx44SRrPQCFZpk4AodKx8LBA;dc_trk_aid=510968212;dc_trk_cid=160531770;ord=740876021;dc_lat=;dc_rdi...	42 B 65 B	46ms 30ms	Image image/gif	142.250.185.70 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699368.318388975;dc_pre=CLTx44SRrPQCFZpk4AodKx8LBA;dc_trk_aid=510968212;dc_trk_cid=160531770;ord=740876021;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=? Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Server 142.250.185.70 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f6.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 location https://ad.doubleclick.net/ddm/trackimp/N1153793.3518201CBSINTERACTIVEUK/B26699368.318388975;dc_pre=CLTx44SRrPQCFZpk4AodKx8LBA;dc_trk_aid=510968212;dc_trk_cid=160531770;ord=740876021;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=? cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin follow-only-when-prerender-shown 1 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	2313958552335286199 tpc.googlesyndication.com/simgad/ Frame 2C26	838 KB 838 KB	9ms 8ms	Image image/jpeg	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/2313958552335286199? Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b505f5d393b6b62983f657a23b1e1919e169a34141db106f666a7099248a6e9c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 17 Nov 2021 15:55:24 GMT x-content-type-options nosniff age 425180 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 857621 x-xss-protection 0 last-modified Wed, 10 Nov 2021 17:32:44 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Thu, 17 Nov 2022 15:55:24 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 2C26	119 KB 37 KB	51ms 24ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37119 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1636547677202025" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	moatad.js Show response z.moatads.com/redventuresgamdisplay60805146916/ Frame 2C26	335 KB 112 KB	8ms 7ms	Script application/x-javascript	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash f40e742b5c3fbfe8b422267d62427039ea3fc64f314e0507ad8f9418069b5796 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding gzip last-modified Thu, 04 Nov 2021 17:56:16 GMT server AmazonS3 x-amz-request-id JKACD2Z83TEFNXN6 etag "f312b221978540b1bae8fcc427275c6d" vary Accept-Encoding content-type application/x-javascript cache-control max-age=26848 accept-ranges bytes content-length 114431 x-amz-id-2 vE4N63LrA6CCHExR0NYwfJggxV2yTQuh53zCWlNwnQ9e7dUGpKJcSGjoc1bCkJeUX0tkAeyjyBw=
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	111ms 110ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	110ms 110ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	137 B 270 B	122ms 121ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash 7bd0c0afa6ff0b2b338f64c0e7978d6e0f70be965cd40d877b5303947b8afb1f Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-credentials true content-length 137 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	122ms 122ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash 5d5d218de8aff3c521a6721b25edf237885dad28400f5ba217b82f0fcbf81924 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame 7875	0 0	70ms 54ms	Image text/html	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021111601&jk=4417576961676516&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 2C26	0 0	47ms 47ms	Fetch image/gif	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstK19WPlGzIIwXg-1iaU6NMJ9C0npxdnVEAEuLwpTidTO4tM1ycmiYmUu9FeMFttQfksohgAqIDecjBo5J8A7BfdpMj1nWdQpbaSs8pBiY6KYHUqs-fMsZIDmhASb7EvWa1Ty1DVecko_nGMbtUQgmV6D9AWoZyyGuoe5lKQT2R1zAFwBg40c0bWixSfTFIi4ocYAf9mUMTNFMGIZ-NW4--XkefZkdvIzKIUY28tuei0lgX9RX3RVxUAAGO1KxWAhUfT7dZcA8gTAWp45HuAJCVJtPUtYKpKPSNZAx3Zn3oxztRNt2gtvFFAs6qWMF6lE7TJq1Klg&sai=AMfl-YRE6yhH9Zn-1dq3ut-va3syK48z9F_3I8MXeRsArTSnyU0qEJgyudVYF0odVsAehJOvD43Kt8t5FmJBnpBDJBgqoR31xeFmM-0b76tRWbfl2imdK4J8rZbHuUT5Lz5Q&sig=Cg0ArKJSzADdRqUBDE1uEAE&uach_m=[UACH]&urlfix=1&adurl= Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame 6D8A	35 KB 13 KB	21ms 11ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 979 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET H3	200	container.html Show response e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CE7B	6 KB 3 KB	8ms 8ms	Document text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 22 Nov 2021 14:01:43 GMT expires Tue, 22 Nov 2022 14:01:43 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	31ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1637589703774&de=371634088549&rx=743599421766&m=0&ar=7e5b6a28623-clean&iw=a0d9f77&q=3&cb=0&cu=1637589703774&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&bo=aw-zdnet&bd=security&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=nav&zMoatvguid=-&zMoatptype=-&zMoatsl=nav-ad-plus-leader%3FT-1000&pe=1%3A686%3A686%3A693%3A635&jk=-1&jm=-1&fs=195794&na=1354452285&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	container.html Show response e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FB71	6 KB 3 KB	7ms 7ms	Document text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 22 Nov 2021 14:01:43 GMT expires Tue, 22 Nov 2022 14:01:43 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v29/ Frame 2C26	15 KB 16 KB	28ms 6ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,700&lang=de Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 19 Nov 2021 13:39:48 GMT x-content-type-options nosniff age 260516 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15688 x-xss-protection 0 last-modified Wed, 22 Sep 2021 16:13:19 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Sat, 19 Nov 2022 13:39:48 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v29/ Frame 2C26	15 KB 16 KB	32ms 11ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,700&lang=de Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 17 Nov 2021 17:56:19 GMT x-content-type-options nosniff age 417925 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15828 x-xss-protection 0 last-modified Wed, 22 Sep 2021 16:13:28 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 17 Nov 2022 17:56:19 GMT
GET DATA	200 OK	truncated / Frame 2C26	210 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b2492a1a9c053c9269bd5badf60a84ce749c0a5e7c21bb9f55233c81374178ab Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H2	200	n.js Show response geo.moatads.com/ Frame 2C26	96 B 269 B	41ms 40ms	Script text/html	34.246.74.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-NiIrBeoFGpG4fz6GF1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-EcfEEAlWe0wLgg%3D%3D&sc=1&os=1-gw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=121&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=REDVENTURES_GAM_DISPLAY1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1637589704174&de=963698074774&m=0&ar=b4494b788bb-clean&iw=5b2ce75&q=2&cb=0&ym=0&cu=1637589704174&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=5029661432%3A2929336068%3A5823350303%3A138371350639&zMoatW=0&zMoatH=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=3&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A127%3A-%3A0%3A0&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=195602&na=1687051948&cs=0&ord=1637589704174&jv=1072254550&callback=DOMlessLLDcallback_95220424 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.246.74.180 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-246-74-180.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 1485aa9e59f81588d2f9d0e6c1af27bfc0bbc9ec25c3d35c977ab7ab909db3af Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "e783319c2bb1941af9e24b3388933858aef0df03" content-length 96 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/ Frame 2C26	99 B 272 B	38ms 38ms	Script text/html	34.246.74.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-NiIrBeoFGpG4fz6GF1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-EcfEEAlWe0wLgg%3D%3D&sc=1&os=1-gw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=121&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=REDVENTURES_GAM_DISPLAY1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1637589704174&de=963698074774&m=0&ar=b4494b788bb-clean&iw=5b2ce75&q=3&cb=0&ym=0&cu=1637589704174&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=5029661432%3A2929336068%3A5823350303%3A138371350639&zMoatW=0&zMoatH=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=3&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A127%3A-%3A0%3A0&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=195602&na=1356651531&cs=0&callback=MoatDataJsonpRequest_95220424 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.246.74.180 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-246-74-180.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 653b05edc4a1abaf40d093df4d3cfd557c72233f7d678633c4b2c60ff2c363ad Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "5ec4254568b8cf1333b5bef4fa296ee80c6f5a6b" content-length 99 content-type text/html; charset=UTF-8
GET H2	200	pixel.gif px.moatads.com/ Frame 2C26	43 B 260 B	14ms 13ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1637589704174&de=963698074774&m=0&ar=b4494b788bb-clean&iw=5b2ce75&q=4&cb=0&ym=0&cu=1637589704174&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=5029661432%3A2929336068%3A5823350303%3A138371350639&zMoatW=0&zMoatH=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=3&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A127%3A-%3A0%3A0&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=195602&na=1904116946&cs=0 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	container.html Show response e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 382A	6 KB 3 KB	7ms 6ms	Document text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 22 Nov 2021 14:01:43 GMT expires Tue, 22 Nov 2022 14:01:43 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	container.html Show response e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5681	6 KB 3 KB	9ms 9ms	Document text/html	2a00:1450:4001:82a::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 22 Nov 2021 14:01:43 GMT expires Tue, 22 Nov 2022 14:01:43 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 2C26	0 0	43ms 43ms	Fetch image/gif	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsukAfgAgV7VNSa8iTmx18anN1yZQpJe5LrJ_0lRwFJHv-k3bkRZwhPL2LuJuUcWYSXKIstRxwtI8eFx2-6q4VvI3wjtL6a3-tUfiO21FOamJ2v85XBDb4GgbWKI8iQPwTj1q7fzQX9CLGKQvIpPge7woluxNhRt7khCKd92xHsQ7_DlvfdpMvVwqndGpA51AXJi4ep-BL6w_fbBm7K7OjG8caFDgDm0fzkUT6xJf4Y6PsataH_vfxCOafNInvrHRDHUK57suIncLPAl218rzyVzzgg5ePw_6kamxDhM7L3aB_7IuriTxOgzHKF0irdKVyqdbDI0gJ6h&sai=AMfl-YSYXjfxJ_plabLTvIc8D5YHXZuWvWpGLwM9AVarKGqb7v02sjvIkaZmRIAAnMTxkfq_PR7LMXgNG5vPmiDPAd_50I4VRM6qWnzsh4fqz88o0OugPZ5VtC_4gXx2CZtC&sig=Cg0ArKJSzBmqLuFkoHI2EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl= Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1637589703774&de=112648038764&rx=743599421766&m=0&ar=7e5b6a28623-clean&iw=a0d9f77&q=4&cb=0&cu=1637589703774&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&bo=aw-zdnet&bd=security&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=middle&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-middle%3FLL%7CT-1000&pe=1%3A686%3A686%3A693%3A635&jk=-1&jm=-1&fs=195794&na=703434247&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel Show response googleads.g.doubleclick.net/xbbe/ Frame 58B2	624 B 733 B	41ms 18ms	Document text/html	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCB1QIQxJTHpAIYqZXPsgEwAQ&v=APEucNXnDC5r8IZhpzaDuOvtr8wzIuGVGqxOeyJpnPpnAPEklTWzwx8tMm48Vsu5Vf_Zo8ylr4RtI-dUGauTXa_APuJvlKfJTz1CNNEoAajGc89gtBBeMng9e0bCT2u_2aXOZU2sJ1rZWbcW7yEf4mvCyTEx4u_g3Q Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Mon, 22 Nov 2021 14:01:44 GMT server cafe cache-control private content-length 276 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	ad Show response googleads.g.doubleclick.net/dbm/ Frame CE7B	25 KB 15 KB	59ms 39ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D03IKiu1GzjuHZOeALaO2FAOQGigaSMl3FDcGbbPe2NyJ5FXsJVU3wFDTQRRms4SJtuqCkGsWNjD5P43C1TS5joTQ19gR_7PS-DEHlkNMG0ogM3A_KaF7hKe_ljYLg8rXkZ57r_vcKc0u_2mHFdGpAwkshSw&cry=1&dbm_d=AKAmf-AGe5UPFUDnE2TT89C_xdu4_7vdwVrCrBTjoER_-6HxWrlD84jip6Ldq8Vpz2UWPIUJ4QJVJ72MeOKBS60zTrv-jtt9mgfBBBx-_QWYarU4P_iB3rKFJ9NTZSnvDH1CRrOPd5MjpO8A0TFu9hf8yQf4fnMca02YpIq1Bpb_wKXWBlUTf1OfrwkbyzaiFN15423DR2EpgogYTbf4_4lb7HAALx7NtCJFHX0qc9HONjgDxproGFx3xeW0Zse5yHvP29BA0LMGfh4Dli43Udp04fLqcKG-GRAhQz63pCWr_NH3B-CWtlL4qb6zKWlq_fmKE7-GqZs9DGuj_o7eaxYwqfzO-KngbXz7fCRcf2KC5L2qFJ2vkXW9RSLDux3UZyCMIarcM7fxRjsUoaHnN9Uv0f2evxzpKSiDQltMqzLLLsL0xdyvj7ckzKpu2NUjXvcFPif1HmcnNihT4huQ0fJAavX5Ppp1_Z8hkFYFs0IMvuHDPJGTg3Zwlj7CabzwrA2U5zwUComo9AovQZJ85cJekcmRar7nIoxHFqIbSub_uoWVA-Ij2ju83fvy7tkB1tGkpUsJnV8erfpJzJHWyCdbQ4fS2d4EAnIFAF396eXBdOzr66AltUZdHKgVZtl2WaEx0m2wYMAwJJOyN4Oh-EDSmN9J6itokyy0VF1eD_0aHYAgKfBzzbgvRIrlZmLB9P3rWmJr1BviRGMhLWgPaOK_yJHtRXm_udA-Nma1vi7pSHpYGauoKoRV5I4MuY8YACBRqOL8s-K82NVqCoS0ENfRtbSEsFI50YmVVeuNLTgwOoqkB2k1_TX0x0Km_yfjSQMfazdl85MTESlqRFzChpVhD1djcCTsnnY6GwvdFVpBRA50DvDJjKUQM9JFCodVCYhnqTno-1oteaEhmPG9rS2Dgp6I9_fkVosU4XYj451oS4VgSZYkpE7gXzeaO9W5g764y89BlTLRXtCmysOquJg9H8geyNnSJpPLpE27-Za6Oism8RPRtAnamfOmt8IPVWGq0n_hfsli2880TLFjMpQ-Mrafl7CYhonF3KjxBwa0ONfvONrnikD7_xEB0d_INmKqRQ4G4rbqCeKpbiOe-ybIT5UavI6bdj-dTzQ49IjWpD0QSll0cyZUyy-k_xMqC-ARHoLKd29H1vQJejkc3zZ0D2xdHKLl84veBp651zQnq5z88fff_VSCvid6Tx4sT8A4W3gXC7zgJOzBaXamp27nV5XXoeKz47kbcqU-xW1TClfV7jr0ROOP_5HPs1aAEndRbXXFRaJMil-7hwdSq-7unfx7qLEbJhHhQwXXuaHqOvZrCZPV6hfb50b9hGXroJbBtbKz9IFM2KgzgUOOK8edljm3ol1RLzouzCL_YhV0ijJIgkhRaghjPXATyNJfbAhg5rWS0Ti8HTlGgAaWOqZgUIPGiTtkqv8VOQu5t7YhvLA9FG3ZOCHVEhg1iypIgHaIfIb8GZPxT2VB2RGpYjq3773YcJcsYpAXOYGikAsHm2BacagvJsaw4cBGcgafhdh17KPzL95KDfc5ciVc_yGYgoFuEe4DgU13eLZgu7IuwcsRnhiJXY15PcKqMmto3QWqf2obbCZCcJz6FQ7U4aiT3_s_Q7Z4mvuIOuKgRnBA8wy4DH2WB1jniZyR4yUn8ToTVl8WgiwhVO69CyoaMDvplG-eXLjw2TrGRqPPaYWYIZCd6ekXjpL5RSXYg-dSw_R8PsuR_twOZX5ayQLOQ2je5wqy5YP_hK02KEdkOyz5CZnzR0-o0xdbLl7vN72JxR54nVp1vCEan1hlyUCeve0PjdBRlFaOdxBUjoR6awBs-kqdsQ4fIV13ZbGBHhTHdhEU__kF1JLFhM3g4aYg5gIiQ8JgCJDmLQizUk0w5B8YmQ9vdOfTgBja3ttmyvPaspKX1r7YwRuu414OjOLspvykvz3rBbtT-EIwGr5Og2aEH4nWqaqM6U1tZTvAMuXAACw6XElPiwjF1vhe-oO-p982TM3t9ybpEhg5RaHTM20pORUKUjqJM54h6TFPVV9-3bAOlNwAfBNFREAPplsn4BZlc07IKMvR-dRuJCRdofT3W3ZqF1tj4hbi_5fJEXrbz7dhou7IHToawKeNTtoGpwTyETxzY0Iff5md6eZDc0z3XsWC2RXY72IqtNYiF-Y-ZIyxWVNS3GwesW8w421xh4wj9LoMdbb8imbDM0fo2hCNGaLFwJLQuwZkV4kPBvE-PrefYOOEEKaTcLwqKMGGo-VPrUhPzlTFTaFHd91wWaRICjE_oNhsamHKpGOVCBVXCpX_XMjYcGn56gPlQgjomPC3CCuzn0EMI-a1TwIP2B-E2CW7hquMNAB0rKcsuVGXDvEjmc6xfjpeFPh9apkK4SYIIcYXtmMh13EfooNx7OMvVLpQIIxDBV57hH43EcPtrJHM1767roqYn0IOrHDUAYNPyacnm61qp6PuVnuAELqzNdJduy6HzfQuN9SF0rvkfidG_0DPRkkCzHzMQd8pxos9S6BXmf_PMZrQwzz2pMrXMLRjasHC5N2GDhTTWg3bEyGXTQ0IqMr9CbgdrM27OwvcgRtS4JjBzFQCWVIIDUpIu94doD222-Q_7KEaVDKZPdFP-ykPDFEBlvOWaEZ3YKTRw06L7Gu269cor8COadwxb_j5IjeQ3TnBEJIszdpO5bqTnhzGZ3QKPDCXiX8PtfmycZC2n6lfu5IjfprUNjCAg00TBkqmZjggZP3e58eE7S-Xqb-6FMtgc6ImZ77AdiZ1Lq0MYfKuj42I3PtMxf4r6lEvH6g5tB-t2Eh21cc9LCk1DviuzVwwoyW6v9SiHe4UtqPOQuXUXy2gWvg-r0Ce6MiPVC-91QNrsyOCnmclPMGOvEyBwZzxAfmUkSTR26phC13zEJTMKnHGq1ekt4CbELYUPDVUX0HcmUu41wGD7-w08bnASiQ7u33kbxDsNiFNyjBs_W9eIqlHzmL8TUTjX9ZxNyQhiBGqAtO4jYlLcnuwfqJ0vU-0MlQy7wFrqJsJPcsPL1G_JBz0sJubVbfeNQDAKpWmVvA1v-h-h9is7fELgmk2r2UT2wV4s6JkCgA_ww9uFY0cyU3CQw3N0prbTaB9XPT8dvtv_3CsN8rGM946t4Ns6Yr714itwOTOyCNPPzS8ZQhDE4zJe-bDQpNPtA45ME9qnIY&cid=CAASFeRo9iFoekptSkOwjKnn4HIQU2iAqQ&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fnew-banking-trojan-sharkbot-makes-waves-across-europe%252F%240 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 075d67c695ffb7178cd5f7e445839688fc80658a2bb2552783b555436d3717cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14792 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	gen_204 pagead2.googlesyndication.com/pagead/ Frame CE7B	42 B 63 B	42ms 41ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C-g55ky8-e64Nq7p0awuybU1vRmsuCmM-nQ91OOOgKumCS8VprndVECViSlCmKCjJbN4U5y2qUkvgrNUYV-RwfGLbFKYK-7MgKrYn_YjtzHuYUQfQ Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	dcmads.js Show response www.googletagservices.com/dcm/ Frame CE7B	9 KB 4 KB	22ms 7ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/dcm/dcmads.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ba8e38c6c85b0384447b0174b6e16c72c56acbd084c40db40abedf89036f080c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:23:00 GMT content-encoding gzip x-content-type-options nosniff age 2324 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4451 x-xss-protection 0 last-modified Thu, 21 Oct 2021 15:55:37 GMT server sffe cross-origin-opener-policy same-origin; report-to="ads-dcm-tag" vary Accept-Encoding report-to {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]} content-type text/javascript cache-control public, max-age=3600 accept-ranges bytes expires Mon, 22 Nov 2021 14:23:00 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame CE7B	2 KB 1 KB	8ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:51:08 GMT content-encoding gzip x-content-type-options nosniff age 636 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:51:08 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame CE7B	119 KB 36 KB	71ms 57ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37119 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1636547677202025" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame CE7B	15 KB 6 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:52:19 GMT content-encoding gzip x-content-type-options nosniff age 565 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6415 x-xss-protection 0 server cafe etag 16810888504096353422 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:52:19 GMT
GET H3	204	l www.google.com/ads/measurement/ Frame CE7B	0 0	32ms 15ms	Image text/html	2a00:1450:4001:829::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRnjru8jt7Gnm8BZQyg0watDHS7GnL8B9QVqC0aH9qizyRTsr63GjJwzDlSJyMRPnoeleBUtWu1ssSrBO5e-653pa343g Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers
GET H/1.1	200 OK	pixel protected-by.clarium.io/ Frame CE7B	68 B 345 B	45ms 12ms	Image image/png	18.157.213.64 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6NzI4eDkw&v=5&s=v31fl3v7nn7&id=eyJkZnAiOnsiYWQiOjUwMjQ0OTY5MTEsImMiOm51bGwsImwiOjAsIm8iOjI4NzA3ODYwNzUsIkEiOiIvMjIzMDk2MTAxODYvYXctemRuZXQvc2VjdXJpdHkiLCJ5IjoyODkwNzIsImNvIjowLCJzIjoibmF2LWFkLXBsdXMtbGVhZGVyIn19&sb=undefined&cb=4802103&h=www.zdnet.com&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZOekk0ZURrdyIsIndkIjp7Im8iOjI4NzA3ODYwNzUsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.157.213.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-213-64.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/ Frame 2C26	43 B 260 B	7ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F2313958552335286199%3F&i=REDVENTURES_GAM_DISPLAY1&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-NiIrBeoFGpG4fz6GF1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-EcfEEAlWe0wLgg%3D%3D&sc=1&os=1-gw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=0&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=78&w=150&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=3&f=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1637589704174&de=963698074774&cu=1637589704174&m=84&ar=b4494b788bb-clean&iw=5b2ce75&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=123&le=1&gm=1&io=1&ch=0&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A127%3A-%3A0%3A0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=0&of=0&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=68&cd=0&ah=68&am=0&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5823350303%3A138371350639&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=0&zMoatH=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatDev=Desktop&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=-1&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=195602&na=32944067&cs=0 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	pixel Show response googleads.g.doubleclick.net/xbbe/ Frame 8C61	624 B 297 B	34ms 17ms	Document text/html	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIYsciAugEwAQ&v=APEucNUk2RYTndVQ7MuV6H73FVA_NSZ39jD5uh8PqlYR1r3timqSnaAuYjB6_DnV-TVNrnpnScf-mkucBgBW-uQ45RW_EYFjzR8BR6Xp071DB6vNEpUPdieKc4LQWSQ0S7eA8uWuxUmwc6E3AhfO-nKyWiYiHJhyPA Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Mon, 22 Nov 2021 14:01:44 GMT server cafe cache-control private content-length 276 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	ad Show response googleads.g.doubleclick.net/dbm/ Frame FB71	76 KB 31 KB	64ms 49ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DWyO6d47hhGdSKMbdqsJtx6KFoqpVoZdp2vbv9g1hgTeoaYuIQgXQzBkzfQHDSQDTmZ7piuDx_esq_z1CJ3MELTJlpow-Mdu3V3Sottmb4Ms-XD3lslrZUaBTxLmxVIdztdwK0ySXaQI6SiOOiADnrkDxOgw&dbm_d=AKAmf-D8p6irQ05cf8YcahbJCFOjbctjyN2DRatpf6L1lbGDU4jn2iimLUPnab42mZ5WWXT8_Z46K0YWAVfiVhZx88e6PVDd-_ptGTy_pyBW___oApB9slT2Gbr0sSmxNLRmcFeaAe4VceGRoW5dCmTGNWNHGYcB75lVot2y7qFPiJKmiFpwD2hGm8XjsCn3AenICRbuUTo1DwmZzvG3EeUOPOO9gHG3aEDB9Lbrzg3ndokHXaEw3TfMgHL-9lR_fAUa4CO4vT4xMhpR8-NPv_hReAjusI6Oo0F1ynnzl_dflVOAVd1rS7GUvHo1qZWC6AU1-PIxlwG_tMjVouyKZAJJYjbbMzLyznz6h22s8Vhhf-iuIAPi42lw2YOhnohqSPHBr9Nu4btEUrq-Sbqaud8paJmJJwML0FAFksnIv7vqufeJiAGnmy_kFIUoHk6Nb_jujbDBF9e63bkcIR198BhfDtJ92mzBWDSiexF9obm93TZLKFXEca_pXhjnc_bx9ydiYaiHkDf_KTfTxPFyaiHsmZDF0PkYZVIa7z7nZZEhUgSa2UWi8ytJZEVF-xU8IP_YRY0Ctc2gpcEKdC5UtPI11t0fjnQexov-gNbqtdzEg-JhKzEChMBnqLGyeoY9WGO-rGLE5V2dpnHSnDsWBgyCYk8VTt67uO9A10PJtWSrVNPNAloR9VzgLVqsIl5HoEFnD1KPaJgRsVE12Gbtf4VCidRK_YhiWCU-yBj8Y-K6FnHTncsDRLmE-W2i2DlyQhIbynFxuxjURsp9-34s2wvwNDiKE71fLw-rNAaZL36QdPeBL4-RbVzl21UepMWgsJfz0zeLNosNtrhc6DRUSNVOec0ZGNzIY3slwyvQFBfVQatHiRWSBQpMYPS7ci15P9MYkzY0QUIdDxDLPMY99Z1VvoQ0tdY_nmJH2rxjOp2dEB_cXjqMyRapaedsWlYpu6M8FNWkiec3PV8cTyHUfwijjoynzVY5DzD-4iovWhcjWBrQqMGxM85HaGVZntLBnKdtlYUth6-rIhVWMglDXP1ECTnY7uWCGav2cjAhx_GM9iTsxKC7IP9rVTEvh-NME2fYZ-iBUCQ9gjfDlap_B1HuuVvL7qW2v6ibQpQwc5g-5R5SpWB_GL9S7TzWX11V_dQG0gUTIo3iHPyF3kRZoOQ5A1flYhjNCqL_tLjEALanhnnuBfQFDFR4CWS_-qzc_AAx5boWYKQOQ_siLHNBAtcGY49L1LdaHb3fRdVkJhWWSfCJpFHwPyjL4pHs9KuzV57-fm8asWQBsVS_khNevEwuoB5vCPjF3TN_vd_3sYjfPrjMtqWiwpWiXKA_15mwR7RLQ7K-dXhwSSpkuBYYc_zyb09Xl6JsvbAg7eQDBbLOZSm1SHpBpEDz51PZ7U3i69mYF_zU81SXH_rY62MvSLwH07ytj2K2KDHY9-gbaDcUX91VWoOtoSfP9HUSEifTSKn8sp51BQFeoKjweEtCOHerOu794aVBbpuHvGS2fiKZTz49jmFB2wSuvGN9UAQbEe8soLLIqscvcxgBNccm1uML0aLth1CvdUe72oefwwHDIlQR0rTQhFyZQnVtnWy29iS41wusChhuX--0cqFlgVik6IDv6kw1Ix-IpL0R5bhk2hcj3NqkHcYa-PJYyv1p_uEbyJbjUq5Gje_ycqFhRTojw-yuT5nTqp2XRyBXbkdYYbNV_iazYInOA8Ag4QX4U6nFlSNzl2BmKSY3MNTQxxrLwpm0zigdjxUhQJjyrt1icd7Q6MP2sQSihjjRNqXj_oSjWS9K0s39LHX222gZMvvAs3kWw_1Cim93g3ba4yaeBEYxsZcWnmBciNN2_nOsDZRx5GYVPyxejj9-DwjMEyeof6zssK3cWEQywN8TmYsPGgF_BAdtmovq4bCu__HD1BlyxzqiBgbCEK_kZafOLdSmhPGYaTFshLgF2czGMfRbZPxKnap8vfat_YSz20st8uHmr_RQufeJDmW5rlfs4KhbawGBzh9d1JXHbdrUIh66FDhZZV86H5GZ3dCcrWdC0siN9TttVSU-OgLPT-_jUWfpU5i0WoXu3Z9yROdeCNOt84sPBAVKMN2C5sVd11tQSIGo4cNdQSpWCkVFnlGHba0puQDg8tZapacRO-W4EcimXpDWQqJmReDrtesfWk6BQKDqgK9uAUI00qNj2xNkYH5SOwgH5AjtcF9LhTHi5pvJfaMFHWDe9oDxy9P3Ta-_UZFcodYYDf6xfS2UALKLtP3RsnqsbhZtrWpMslqujR4iJGfSeXk8cPk9zxh5ZeKZM9okAKTRxixew3gEtvlnuTKY_CrcGRB3xy-_zWou4ABOqNxBVTXMjGhGUIv86sS5KAosb6o7kqoozbiZpu2TfbqyJsFyypQIbYATLKGHP5gZVUzEriViVxQKApIPjJnG-Shn_AzkjqjrWQDIN7-6C4gF4JOcF2truI5b5ehqV3iUyTyZJ1QPC8nAS2N9FjmMQY1U2oREX-9zChHgZOmGGjr3ZNL8cfDitf4cyvVk5Rg96-NnSMQT7069J4wN8mXdJl1-bMkjkbKe1j1v7tgY0GV6JxTws5JEnmghSWEyGfJtFE4D3qZbdFIdtgpYFdYOgXsT2Pfuj7K_Y2nXaS4jXIUvn6LJTPnffBcp1XmdUVQjHNiciqEDt5amKk5Zt4pbJg599vddyeli93XtsbjIQfUjZMRBPQWfyyi-Kv6pR3kOyd6beFVBT4maEVl9_ewnSm3SgJAVbCa-VBYY_2JFCeuef9gUMqJ8P2iJ597xKGg-MRQkfW5AbKOCE00BtOWFb_UCy8SGOmfejf2RzBGazdaVnASIn_XwfVhYHr3aZQhkn5cFPg6B2KADcQKJ6w46P6aVrWVqPgjUZZ2Ff2Ype8LmGkm4XxJyxD2G7Jgw4HZtqrBM_RoWrAsBz8dsfzyodLVs39XNT8qX5aVqj9IHLdlB_JltmJREgh4nteIyNEArp4eG0prdkI6zgMFl7RnEm3FD8hyOIqENPx83N1-SYrXVQj88ZEAU1Ng2_-irkEeCowHgU-VMffp_c6BAA_7Ic5qdpcMF8DT2GsJh-p_rMCXwqSnC_gu3aIMS5G3MmW8WbUs_yazFW9HkdD6wpm9gXRCsI0X_g07N609-wMVLZHYNCdvuF9IkZZMr3mwE5kRHUbW2vAbUNIpi5wpuzLuV0r50p1z81MBssmYY_Lj89VwiAHfOWHoJzA&cid=CAASFeRoKB91Ma0Jqx1fTniEWLWJIfVJ8w&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fnew-banking-trojan-sharkbot-makes-waves-across-europe%252F%240 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e62fbc9f4ee63d254c732b6d1f6bc5e8aa6bcff39bbbd40aa04dd6726daffba4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31471 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	gen_204 pagead2.googlesyndication.com/pagead/ Frame FB71	42 B 63 B	45ms 44ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C8suT5iM2C8FPz0-SgVRCxh_7iCmivkOrhpNO24rRQHgGdLPNV1pNzALGvlKPgbo3xWxFEVrMFjC6m_3PGrHOC1wziQQyPRltitxgJtFJ6ikILoNU Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame FB71	2 KB 1 KB	8ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:51:08 GMT content-encoding gzip x-content-type-options nosniff age 636 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:51:08 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame FB71	119 KB 36 KB	64ms 62ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37119 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1636547677202025" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame FB71	15 KB 6 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:52:19 GMT content-encoding gzip x-content-type-options nosniff age 565 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6415 x-xss-protection 0 server cafe etag 16810888504096353422 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:52:19 GMT
GET H/1.1	200 OK	pixel protected-by.clarium.io/ Frame FB71	68 B 345 B	20ms 18ms	Image image/png	18.157.213.64 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6MzAweDI1MA==&v=5&s=v31fl3v7np4&id=eyJkZnAiOnsiYWQiOjUwMjQ0OTY5MTEsImMiOm51bGwsImwiOjAsIm8iOjI4NzA3ODYwNzUsIkEiOiIvMjIzMDk2MTAxODYvYXctemRuZXQvc2VjdXJpdHkiLCJ5IjoyODkwNzIsImNvIjowLCJzIjoibXB1LW1pZGRsZSJ9fQ%3D%3D&sb=undefined&cb=1559596&h=www.zdnet.com&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyODcwNzg2MDc1LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0= Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.157.213.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-213-64.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/ Frame 2C26	43 B 260 B	64ms 13ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=68&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5823350303&L4id=138371350639&S1id=22308610192&S2id=22364980590&ord=1637589704174&r=963698074774&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	9ms 9ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1637589703774&de=974567281937&rx=743599421766&m=0&ar=7e5b6a28623-clean&iw=a0d9f77&q=5&cb=0&cu=1637589703774&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&bo=aw-zdnet&bd=security&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=top&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-plus-top%3FLL%7CT-1000&pe=1%3A686%3A686%3A693%3A635&jk=-1&jm=-1&fs=195794&na=1989154489&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	pixel Show response googleads.g.doubleclick.net/xbbe/ Frame 85AF	624 B 297 B	21ms 20ms	Document text/html	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY_u38uQEwAQ&v=APEucNWVMdSnHnle_IiWeimBTD5ZoyO7qG3XM55v5b3rED90JLV8VODqgkwuza14GgMAJXvDWD1LAmurFvCLTtiqwUqAvVBJjb0JEdu8CQAIY9l8Z2x3w1MeotlksKouQ_EE8LPIzzKx6iaYaFxyqFF44Wnv-8wKUA Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Mon, 22 Nov 2021 14:01:44 GMT server cafe cache-control private content-length 276 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	ad Show response googleads.g.doubleclick.net/dbm/ Frame 382A	76 KB 31 KB	57ms 56ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A_X90lHL1F1Xkq5sFk6pCNbScflAvecaXaNjX0_9V3esZphCDMpsVxRETJcYBGU655kgNmOw-V_J_0I1WS0FTUWsesKmQ3otZTugT9xgP1dG--5oCc_SkHZ43qlsPjoY5RAgTgfmZsaqXNmZAJD4A5X1YEvA&dbm_d=AKAmf-Cmagc2782T6PWp3EFhijgKQHcPjQY1CWszhECZJYzq3D6fr_oQVlVqdDwYLuOOl4OE5iZq3FQ2LLN2ScZbqG-JBdGIqEDz7-vzXIPhST-NsHXkytza1riiWKe-HdGNGrOQcxRJicWqrbSt2Vd_AN6vCfDt3_vJKLQQvnWqqpfHF5nzlaQs_tYqKdcn94E98yj6a3pFHpj3-pJ_fp7KdFh_vf6KME54jQ3Nz2B17LKHKGGu3al1iwuelVjhKifj4W3mK0P6qy4fzN87PsASXSm1fl_6uIh6Y7Drqzc5ojKd5ifVoGQoCIvX5Uzy-VGXKos3hf0SfItN-HlBWDCG1v07tLkRjeZE8CCwAcIxrkEfI2i6rreGmT-3pXNsqSqZqC6BQj_crLJDeqbtHLOFKkCUTeNEjA1veXU6dId_osS68WrwgPyK2dT6FvRDxhg9Af00_E5x5ITF3Dh85WC1dtSfJSv5PQz9O_IdVaWW87FYbl3-OpP8f7deBhQyGHmuYglK2LQtF7teFUZE4yTwrERbWSj4vC5WP7L1eGr2DUFXxXZBjuw255IwYc9fbvXjQMx7F9rwXqbZ1G_x_sPEz-NWqFwbQspoIV25x_BedjeWo_htGmotWmQliPLwkmazlTMnnNPgjyBJZXpRyr03H9c2Xf6O8QPymAhd-OisEI39gNXo3xY9wnp-gnU0r24GuGEE26c3rb2yiJ2g_rVkeRF-Xffa6Vz3-AVX_YcPIy77Li1zzlFLL5ttJyUvKmWlGwEYUsjbhXWBNBVTnKhuf17OrfEeNZDBy97QrnSasPlrNxz0D6fz9bLLEbGiaKUkH2wEJ3cFBpBpSQKNiIZIIAER6iMT_LvgNVVae77MxkGJCrCXP12Tyq7IkTcd98ACvWYr6St5xHsZmmmzEiAC4_2uFEFOqE3e_psTlPHQ4_nuRrVPw3QU4zNwWm-k35HYy4NfdFdXA-QL_yM8L0s4k9o6pCoGnFVljJ0PG577hx9iSVVsVHTS0cT0c9zMGDJ7sDDgxacQt-R3iKLv61AH_QsHUkZUFWWZ21JrQfMWdqMIXPyEn0-ydScUhVXBw6NTGKo8kVdpn431F-BJ0Vicc1ihli7RzrcCI0Tb_kZjU0nMXm-0VwBF3q9sbzT56_pECLOCS48o9GXiU-1bc40s13x-EcGj2-VOzUuBKsbT4ixqwoospe8d2M5_HW0yBWNFQ58ZgDo9Zv_WCay3nC9ltjIluctEpOvAiWhEf043SmuV56lYgZsyQQPwoXn0jQfY85e_Oa-nEbhyf_thg_zVbmGJzjM8LKqI-8Jv5tuGA_bNbW1eedykIqUpm-uX8fjfpcqyjxNVPA3b9XYAapgkg4e9No_PYti_ikDmKQtj51UU8qlHMTUqpu3CjA7Sal1ChPIkr_UH8FNJCnqtnvvTzwjKSm5-RtYUCvebtdc1ScBDfE2KnVbAabTdZFCngAyYDm0McGPNEA8RI3dr2N0yuNdOOmGpxRzZgY0A3jOceC3RJ0agAhqM2kBkUjTLSLDt9qTOqutY4jw5ibhjQL5gBE07BjnBC8U17R38F6lCTJmuHhlERkfAMILSU0_sw3iRUAWMMd21nMU4qN6jlG2VHG2Ot_nMjBPHDI8iYheAYMvJw6hszGqyPYskA9M6ihD2VYjPTmm0AEngiGSbAw8YAOpqS4-5kcq81iOWaWtUkGoaTuIOqlJjhiSil3-sATnosWfiCu5Syb2J2v2tt8iboJXR4V4GuKuBUPzLlSsitmkjZMT7VM2qVF0HEyz5_eCL3KeLlNY0ZVi0Qig3h2SDn6oJsKriEaQKjq3usCS0n-afFx880PP0pJnQx-UXfV3T0BHgE3m1pF494oBG1QZ_QohBw8KoYgptiXYfSZI2mlAw_hY-kFsuf5d44gV4u2kDjZ5SGALqJCcRPWZ-Nie6znOqT9cdag6gaJHbaWq9-YYxMEWGR8qcyCJT2tYLBVGw4eQSeBR6mzx_FI1PgzIt6qxr46KL1lQQVKI6k5tvVJ4xD3bjmfuPOfrxRRs7luX8zvByEIAmcdSo8ZnBOKhqFR0idcDc_DTjYqCDh0BROaGZUL_m0hUkPntK2EPeojM-yMk9pU6OvBbsR8CKlBTCjAODCq0v8y3_vzu6OrTcg1vFtLtrutOaLTXJa7M9XdmahW2vKu6Xqm8VMgJUhawl40W2uFB4CSDYYlCweR6No2JCQ3fpVIUeqDTelp62sMnHwkw1iQiWj-u4fM8dsJ7EK34qb9mCwVg-nI0RXJx7EFBmQ84a8xunsxWqaE1v8INvELpFYBSCCqtSCaMM0iajryceCNKqGqCaQIltKV2ml5QPGPxyjRGAM3jDjNoDqLj0SC7jL4PPsbU_mpKguugYd6jrJLfwjk1EAySAcdzGkoCOPtl5kM8EHQgXJsbHBmDA_u2RlVjpZc_KcWMvRhiwLmwhx5fhRusosB4noLicfY9bKQpjYVYGoJt0agAA2-aMQWCzGO4xay-5iX7oOierQ0r94rzGN27TKWuELilmRnw4_yS_yPS5S-rzS6Fm94OmLhT4wdlN4MREqQtjSj4cHmzvuN5WB4Lsa758muvMpjf1gKzr5fq7ocWyf64tr1VBfxCbzIT8EgziQQA9By_796r1aEYNMEVRGAkDTr1GVU39B5vvceKM008faANc-s65xxDH4uOvJTsPZY006a8o-0xpzG6PmP5EDxTk67ZON1kFAzuY-DcD_Hx0RuI3yeEnAgoSDTDLyATbS73CBAeyaUyaOb3_JuGLQwcSj88Zn5770xn1zQUQSnRSid144YBqtdjcLrfTJHguf8serZ7_M1jj9TFq9AWQOoqK3URnBakrWaDyRGsUT5t-XsQwzSiKbTE5xtnnIrvlgkvl0pTDr8Qk3I7PGTmTCDOGS6PYXMBNbirbhtV6l1lyiTWK1yFLGGFP3eGAlm_o87gJ13AuOAihMUu86zUDsyj0o-SJq7ehf6-0K9Uf39dpEZxnXQCFbOtjsxrFk8liSAT47JOpk1to7z1qeWsccdPtHjuh7ayYfYHONzusTn2rMwiPjULOseLBcDyfK7N1oU7P88O-IbwY1qQYqE49D5E-Kcn_0FTLZvpZNIdEqkRJBeQl6OONJxFG8I7BO9P-nHb45Li8ekDsa3Y9RQynkc1RcDwS_ALX1G7AC03Q5PwZ2cdwi4SvoluPtNeFdR_fxvGnLHMen6PX_Jkmkg&cid=CAASFeRo4-edcUeFBDDg4TktqwO1uwNJYg&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fnew-banking-trojan-sharkbot-makes-waves-across-europe%252F%240 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 35f3ad351d7bd4a661172cd4b5d6fa5ce08443e7f77d660bf3bfe27ad842395c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31471 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	gen_204 pagead2.googlesyndication.com/pagead/ Frame 382A	42 B 63 B	44ms 43ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DB7p_MiIyuqJexNJZXUnNwkFR48uI8xKQ5Lhmk2Idl1rTkrfGe-iJQXzpFs-JRacuPoGZUO7erQ91FwGEZ3kzlN9jYofF5UCbm2cO2TPf7bh43_ks Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 382A	2 KB 1 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:51:08 GMT content-encoding gzip x-content-type-options nosniff age 636 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:51:08 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 382A	15 KB 6 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:52:19 GMT content-encoding gzip x-content-type-options nosniff age 565 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6415 x-xss-protection 0 server cafe etag 16810888504096353422 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:52:19 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 382A	119 KB 36 KB	76ms 76ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37119 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1636547677202025" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 22 Nov 2021 14:01:44 GMT
GET H/1.1	200 OK	pixel protected-by.clarium.io/ Frame 382A	68 B 345 B	11ms 11ms	Image image/png	18.157.213.64 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6MzAweDYwMA==&v=5&s=v31fl3v7nqj&id=eyJkZnAiOnsiYWQiOjUwMjQ0OTY5MTEsImMiOm51bGwsImwiOjAsIm8iOjI4NzA3ODYwNzUsIkEiOiIvMjIzMDk2MTAxODYvYXctemRuZXQvc2VjdXJpdHkiLCJ5IjoyODkwNzIsImNvIjowLCJzIjoibXB1LXBsdXMtdG9wIn19&sb=undefined&cb=2470504&h=www.zdnet.com&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZNekF3ZURZd01BPT0iLCJ3ZCI6eyJvIjoyODcwNzg2MDc1LCJ3IjoiMzAwIiwiaCI6IjYwMCJ9LCJ3ciI6Mn0= Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.157.213.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-213-64.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H3	200	pixel Show response googleads.g.doubleclick.net/xbbe/ Frame CD39	681 B 343 B	19ms 18ms	Document text/html	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/xbbe/pixel?d=CLnUqNACEIG2rdgCGLyWv7cBMAE&v=APEucNUV2-BwG7XjJDJzRnBa1uNUNNdf_d8UgJIoNSq7ktkmrr0k2RDPITY9SlSgmj5FCa9rj57YAnxiT2dBGYF04svqEz7nAtnUtyHcr-P_NuVTD_TxuVYAFC2hMtW2t2FispJ5aS_74c3F5Gfr2sfxESJWZqLThQ Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 41dfad30ddd4d44e007bb4483a2e601e1ace97e132085e7443f301c1cba63144 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Mon, 22 Nov 2021 14:01:44 GMT server cafe cache-control private content-length 322 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	ad Show response googleads.g.doubleclick.net/dbm/ Frame 5681	75 KB 31 KB	47ms 47ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BUvIH-uDgwVcyWN0PQjzNeratuDB4OoMrmjS7Rrz2TZavD9yWazL7VF0o3sRKtW5MFhyVuZ_HCndlMY4p977kUog5E7HDhXqfdL7gxgUUijrE39uUWJWgI7ERIozM1M50RwSj0T6TJriUKN7YArM-BVlMczg&dbm_d=AKAmf-AFkI2ejCLJaxkkB_iViRHK-PwQrAw03n1fLrPP3XBbmKmBL1lksMyZwrb0pfxBmyhFTL-e_GJ10EvNWG8UypyNwFUkqkdjyNl5ap6HGuY050RU2VlZCtOgVoLwx_5vjx7R-rSd1K9oK_HPxw4tJdGQx8zB3Td51dl3PkJLDjWl9oKP8ebA5s0f1oXftYDuYPVwHRjdglMYnOt3gf7LJST0SIhu2eRgtf1Air_ZBgYBckbg1851xhkZdBJjfvI88niRc0V4eCfFCvE0Cj5qJi92DRxxV38Wx39-QGbKN94culzSrHzHPrFhMuhIYXM9OBVJlsv9kA4XE6rfotqpQIM6xl5Jnj58TuiqXVklxSaxzE0fmsY-AshfOXniuUGNqv7f4fSTu6fW7PPK36k_TIXiEB3kBGJyrfohaMJNrEUPI4f_DvTi_K8nJPnFbUCibGE3m_lcGvwWEsaJ1rPERTYbVyjYqCuDNtHVja8KONYruwWBlBVa60idiukZtHI6sHX9C92nyjZ7zhrfUjuDASoRJ_CKx-sSiD1wU3If4Y5dKe-vAdUFygRvpv_fl9S-tolHJhTiIVjNrPVgQvQHGCO_eq2tw3dm2rkrvNMAseA5TCNYej-iWeYXnAmjQawhxBn-RyJdhEMr2rF9d5AqI5eGdFT90lF0ZOTBabxllHys89T7pATeh1ePU8p_jwREA2QdqcJvTvGGqOBq8JZZjVM21PEi5pRxwEum0oWHevXas-_bCMA8fIxaJoiYSLkQzDzTOQ29_BwWDN4Z2drbh0ayikZD9LtXFc0gjJJVqavKSk0enRihomZsQJQf0KxX3FOhXK_9S6zLcDeWQScAa5oyZu_7uxlzfsXnuA9T55woBD8MvQ2WmWKCtDVKqadjRUejXES0BB-PeSm5_ya1kfKnvcLBJK-Jin_YT1sTs4KQFL4TU42iG__bWBOD6PZ6ebefDSadzmtDj2FkFAAYlPJCzqzFYVPWrpkhOeAlkXzNGbXmq-9EqbAZi6wjiP_WN2JBts3vyC3s4mhgUhE65hG0USkS75gLi-AYSp6IweOC1KpjSXaP4HzLjCXLsbs5pJN0CScVVOgT6bpX5gyB7kjO2TOfMYUz3XUJYsMwaxQDTlrgaqgJtyGs7W7K14mOr54hjvkBUyu2AZcitJq363TYsNKFPu1hqJlJ019bd8lC844HWi_pML8xYZH5iUIry-uCrgVSjHGxqKXz9DMAgl3KzvJxC6uGm4-l_PnhkjZwyqTRuYcc0--6fkT13LDO8tSPQz0wnn-9mAXeneybegM1ganUII3N3BzZxUQKbJOjn5kjGOLVXfklbWZ8fANIRYWnCasWXVeKp9SUK-3hesknbhs4WGnuXbcNEBVAQcjLgu5uYQrAk_SdHEETHVvUn00GL2i9mfYVCJ5aeRk8CgmDN1YOrSScOxwjnk7Xb9wWp9_g-kkEIR7XInjfzxa0kdU0u-J1CdQmczH7XWSPjUM82s3OpwkXe-vmSNVskNKPUieYLj3mdBJa0gmmMhDXoLfLekpvz8cR9L6D5mRx1LsJ1t9wKZ69dTZ7PDo6PrQgrRqsmEMA3A2A39Yx-QinHxHpSP3oULt0M8gqph4f2rTDu_bqhNTSI9am-9VkaN6bPVoxUfxELUx8Zfqh9jhf1by6Fz5I961X5HklUqqWr7x9r23cqHZs-CvIJPKL_XnXPEQGmnMVSwsI4korL_cDgb0KIi6ge_56uGZkCBAKiWKefJxiR3HBxHXSF0koW7tRipsyHAoJEXrU9TffPJP_K1M27S1PuuVJMvu0roZWUCE_urG8NVVm3HHSR9h7qh4m5LfFyIV0Ksa3vAtdXKdTTPInnjilAT_jziHofI1QRekzyeyMNWSRrG3vY0VMPmKHE_T-DWCkuG5u_gtHdw_Lam8VSkcH1lD6QqJpwNwRJSoHsXPv88PbK3A-wgjdhXXVNMhh3EIIMbzmj96V1ba9wNEfp1oBkzyONXWOoy_ZAO5xXlSkuy8FI-4KtPTq54LurhTr-lVMZXFfKjB2UJ4wYg_JEeS7nun_Qd_XLJwiEArvZxvRU9cVppdy8AMBXL7Sz9REPSL3V6HP2ODrp8yDuA9pkqiDD02o1GPJm1fI7SHTT5uTxlP-xe1-1f27CPGX5ekYkvaklaQgbe3iJ9cBqiHMMJIaXE8wO3yesoFVUbPNKq_jl7QFJqtxDuZ_MDDiW-XEli-Slm2rbAzVIZkCoyefeN0NABEPnNb1lvbH99pWya2_t2HaUhtVdhyEFq9R10lT7RMClBy1fUrxq9vHxyTdRGmKo94sfoUwJtSb8yahq1xJhgLcvsZNDIbOPb9qQmdjGwW0ffISOkhnMMDbjHe7j6gI6QjO-MrqLXo-c1RAK1BPM6gih0DLuWlRa2KgxGg-oRTfX7pPm6ZltJyz2CJEckvhaHy58vtDzATVwvUpEcwebQfUHs9ma183MWKxeyIHjDVegRRtUs86leV4KlSSTSONmcZ-hZd4aFk02_kexLj_6llKu2FLfTJzcSl0WTP62dFMFM31T1KYs8fpmja7h-qgjCuEkXVigBxh1UDOXZSabfPMgYIN4yXWuVhHUAlMYv5irJRY-kx_oKCHoFzwMYcuADw0Ruh3wWJUDfMZ9aFACG-nkmuKr5M4Nj-TonUxMPudl-nAUDnqXONXmjA1STb4yInzV6bBce2C-gLRg8I7dr7o8lw8k-6TCwH1wby9oKhDT1syb7xZp1T5w_9aCbvfuh5ZXhEIPPXY5Mm2_KaRJ1YryqP0e6XzMnRyBCeuiLJL_dDsgwQMtNER6u9OBtKrwvUrBDU2YZkpnPPvoPOv_FK9msFoPQ8CLUpQ-4CNUqJj8imk3irwVakbyopR_qjBHEx1Ku8E2TYFtWu9f6qz3CSrILg7_roZiiazV2uznW09vqYDG5wF_DbJkNb55wrShhuAdqjZLzyLWxq1Nk_wrDuQwahXdv-KFI3S0HSLOKEm8Yr7R77uhF4xB3NMUyB62crO8gKEIKIq4Kp7w1tZbdEjucb1PAteCqNtyBmKAoD5ft3hB24OafZKy4aumzB0_YejFlPDCqkFbdBI3tD6RXVy4z02mHIYvgcGUznLHj2Xx3Y8C3D7xcuq8XpYEqrnrgqcPmD-RGj2s8JHHue_sAymCVletXPdQx3LA593snZ2-Qta1-q3xz3-TRLatxeRJNDb0Q3yH00OJmWX9PJGL_k-kJrbzuYHDiSiTiOziHmoPdej867IDuHzhpG6MxacT9T-sHLQaM8ySw7xw7uie14MC2UQKj18wDFvBV4c3faHPuXDGVkCizehn1uj6kX3DjY4MLZ9Xu_ypLuZDMAKdES9d7XtI7Sn01moHf7KyeQsMTzhff0jT9d4FYihlllI_GDTfy2KPFPXzRbgPrx21UtUgT_kxN613pY-E8j2fWcx4SFEroGyVOYQu2dW9trT&cid=CAASEuRoySPOWuwlswswxOvKChBDGQ&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fnew-banking-trojan-sharkbot-makes-waves-across-europe%252F%240 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash bc5ab367d10aa42650ec2ec266fdc8e9858fe38ff758b48dcf669a40bc208e3a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31240 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	gen_204 pagead2.googlesyndication.com/pagead/ Frame 5681	42 B 63 B	47ms 47ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DsaLkpvJTZbs0_6r3pMWE7n6pqeKfBqqaBP76qwlU3K56y3pnED_D-_SwmJuLriovLsib2FsaO_aLaxBGhcSNpHDq9sWbP_vadKz4Jat8kcg790HA Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 5681	2 KB 1 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:51:08 GMT content-encoding gzip x-content-type-options nosniff age 636 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:51:08 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 5681	119 KB 36 KB	46ms 45ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37119 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1636547677202025" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 5681	15 KB 6 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:52:19 GMT content-encoding gzip x-content-type-options nosniff age 565 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6415 x-xss-protection 0 server cafe etag 16810888504096353422 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:52:19 GMT
GET H3	204	l www.google.com/ads/measurement/ Frame 5681	0 0	15ms 14ms	Image text/html	2a00:1450:4001:829::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaQfR6gYIlQQJXkjso3Wpv9RgQwLo6FkbUi3pyWo3QREG4b71umWfNJSWtrItmnzB5xjtoXj_onEb6tBsa-U_rJb3Z_DNQ Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers
GET H/1.1	200 OK	pixel protected-by.clarium.io/ Frame 5681	68 B 345 B	11ms 11ms	Image image/png	18.157.213.64 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6MzAweDI1MA==&v=5&s=v31fl3v7nrl&id=eyJkZnAiOnsiYWQiOjUwMjQ0OTY5MTEsImMiOm51bGwsImwiOjAsIm8iOjI4NzA3ODYwNzUsIkEiOiIvMjIzMDk2MTAxODYvYXctemRuZXQvc2VjdXJpdHkiLCJ5IjoyODkwNzIsImNvIjowLCJzIjoibXB1LWJvdHRvbSJ9fQ%3D%3D&sb=undefined&cb=6181816&h=www.zdnet.com&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyODcwNzg2MDc1LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0= Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.157.213.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-213-64.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H3	200	abg_lite.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame CE7B	24 KB 9 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:57:43 GMT content-encoding gzip x-content-type-options nosniff age 241 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9475 x-xss-protection 0 server cafe etag 15988442915344899701 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:57:43 GMT
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame CE7B	41 KB 15 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 19 Nov 2021 12:35:12 GMT content-encoding gzip x-content-type-options nosniff age 264392 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Sat, 19 Nov 2022 12:35:12 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	19ms 18ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1637589703774&de=997648044137&rx=743599421766&m=0&ar=7e5b6a28623-clean&iw=a0d9f77&q=6&cb=0&cu=1637589703774&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&bo=aw-zdnet&bd=security&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=bottom&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-bottom%3FLL%7CT-1000&pe=1%3A686%3A686%3A693%3A635&jk=-1&jm=-1&fs=195794&na=727167881&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 58B2 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1	43 B 894 B	19ms 17ms	Image image/gif	184.30.24.241 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCB1QIQxJTHpAIYqZXPsgEwAQ&v=APEucNXnDC5r8IZhpzaDuOvtr8wzIuGVGqxOeyJpnPpnAPEklTWzwx8tMm48Vsu5Vf_Zo8ylr4RtI-dUGauTXa_APuJvlKfJTz1CNNEoAajGc89gtBBeMng9e0bCT2u_2aXOZU2sJ1rZWbcW7yEf4mvCyTEx4u_g3Q Protocol HTTP/1.1 Server 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-24-241.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 22 Nov 2021 14:01:44 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 58B2 Redirect Chain https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZuiyNavuihB01qP1WJQywAA https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1	43 B 894 B	15ms 15ms	Image image/gif	184.30.24.241 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCB1QIQxJTHpAIYqZXPsgEwAQ&v=APEucNXnDC5r8IZhpzaDuOvtr8wzIuGVGqxOeyJpnPpnAPEklTWzwx8tMm48Vsu5Vf_Zo8ylr4RtI-dUGauTXa_APuJvlKfJTz1CNNEoAajGc89gtBBeMng9e0bCT2u_2aXOZU2sJ1rZWbcW7yEf4mvCyTEx4u_g3Q Protocol HTTP/1.1 Server 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-24-241.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 22 Nov 2021 14:01:44 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	setuid ib.adnxs.com/ Frame 58B2 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1	43 B 1006 B	18ms 8ms	Image image/gif	37.252.173.38 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCB1QIQxJTHpAIYqZXPsgEwAQ&v=APEucNXnDC5r8IZhpzaDuOvtr8wzIuGVGqxOeyJpnPpnAPEklTWzwx8tMm48Vsu5Vf_Zo8ylr4RtI-dUGauTXa_APuJvlKfJTz1CNNEoAajGc89gtBBeMng9e0bCT2u_2aXOZU2sJ1rZWbcW7yEf4mvCyTEx4u_g3Q Protocol HTTP/1.1 Server 37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT X-Proxy-Origin 136.243.198.82; 136.243.198.82; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid b8b86f6d-1f34-4637-994a-a0d7854e9594 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Cache-Control no-store, no-cache, private Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 290 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame 58B2 Redirect Chain https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D	170 B 188 B	26ms 25ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMCB1QIQxJTHpAIYqZXPsgEwAQ&v=APEucNXnDC5r8IZhpzaDuOvtr8wzIuGVGqxOeyJpnPpnAPEklTWzwx8tMm48Vsu5Vf_Zo8ylr4RtI-dUGauTXa_APuJvlKfJTz1CNNEoAajGc89gtBBeMng9e0bCT2u_2aXOZU2sJ1rZWbcW7yEf4mvCyTEx4u_g3Q Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT X-Proxy-Origin 136.243.198.82; 136.243.198.82; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 3b23f8d4-e89e-47ac-82d2-34d3b26e5616 Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	30ms 15ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=1&apd=27&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=371634088549&t=meas&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=nav&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=nav-ad-plus-leader%3FT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	27ms 12ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=1&apd=27&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=371634088549&t=fv&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=nav&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=nav-ad-plus-leader%3FT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	28ms 13ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=1&apd=27&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=371634088549&t=nht&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=nav&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=nav-ad-plus-leader%3FT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	html_inpage_rendering_lib_200_275.js Show response s0.2mdn.net/879366/ Frame FB71	169 KB 59 KB	28ms 6ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Origin https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:03:10 GMT content-encoding gzip x-content-type-options nosniff age 10714 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 60173 x-xss-protection 0 last-modified Mon, 27 Sep 2021 18:44:51 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:03:10 GMT
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame FB71	8 KB 3 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:00:56 GMT content-encoding gzip x-content-type-options nosniff age 48 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3140 x-xss-protection 0 server cafe etag 17163059639670574047 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 14:00:56 GMT
GET H3	200	abg_lite.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame FB71	24 KB 9 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:57:43 GMT content-encoding gzip x-content-type-options nosniff age 241 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9475 x-xss-protection 0 server cafe etag 15988442915344899701 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:57:43 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	14ms 13ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=71&fi=1&apd=84&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=371634088549&t=hdn&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=nav&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=nav-ad-plus-leader%3FT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	15ms 14ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=57&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=112648038764&t=meas&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	16ms 15ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=57&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=112648038764&t=nht&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 8C61 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1	43 B 894 B	17ms 16ms	Image image/gif	184.30.24.241 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIYsciAugEwAQ&v=APEucNUk2RYTndVQ7MuV6H73FVA_NSZ39jD5uh8PqlYR1r3timqSnaAuYjB6_DnV-TVNrnpnScf-mkucBgBW-uQ45RW_EYFjzR8BR6Xp071DB6vNEpUPdieKc4LQWSQ0S7eA8uWuxUmwc6E3AhfO-nKyWiYiHJhyPA Protocol HTTP/1.1 Server 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-24-241.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 22 Nov 2021 14:01:44 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 8C61 Redirect Chain https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZuiyNavuihB01qP1WJQywAA https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1	43 B 894 B	21ms 21ms	Image image/gif	184.30.24.241 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIYsciAugEwAQ&v=APEucNUk2RYTndVQ7MuV6H73FVA_NSZ39jD5uh8PqlYR1r3timqSnaAuYjB6_DnV-TVNrnpnScf-mkucBgBW-uQ45RW_EYFjzR8BR6Xp071DB6vNEpUPdieKc4LQWSQ0S7eA8uWuxUmwc6E3AhfO-nKyWiYiHJhyPA Protocol HTTP/1.1 Server 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-24-241.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 22 Nov 2021 14:01:44 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	setuid ib.adnxs.com/ Frame 8C61 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1	43 B 1006 B	27ms 27ms	Image image/gif	37.252.173.38 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIYsciAugEwAQ&v=APEucNUk2RYTndVQ7MuV6H73FVA_NSZ39jD5uh8PqlYR1r3timqSnaAuYjB6_DnV-TVNrnpnScf-mkucBgBW-uQ45RW_EYFjzR8BR6Xp071DB6vNEpUPdieKc4LQWSQ0S7eA8uWuxUmwc6E3AhfO-nKyWiYiHJhyPA Protocol HTTP/1.1 Server 37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT X-Proxy-Origin 136.243.198.82; 136.243.198.82; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid d6c28fa2-a1be-40f3-9779-fa7f7ea8731a Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Cache-Control no-store, no-cache, private Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 290 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame 8C61 Redirect Chain https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D	170 B 188 B	17ms 17ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIYsciAugEwAQ&v=APEucNUk2RYTndVQ7MuV6H73FVA_NSZ39jD5uh8PqlYR1r3timqSnaAuYjB6_DnV-TVNrnpnScf-mkucBgBW-uQ45RW_EYFjzR8BR6Xp071DB6vNEpUPdieKc4LQWSQ0S7eA8uWuxUmwc6E3AhfO-nKyWiYiHJhyPA Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT X-Proxy-Origin 136.243.198.82; 136.243.198.82; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 18e153aa-7056-4885-a2d5-d0f758260fec Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H3	200	html_inpage_rendering_lib_200_275.js Show response s0.2mdn.net/879366/ Frame 382A	169 KB 59 KB	24ms 7ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Origin https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:03:10 GMT content-encoding gzip x-content-type-options nosniff age 10714 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 60173 x-xss-protection 0 last-modified Mon, 27 Sep 2021 18:44:51 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:03:10 GMT
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 382A	8 KB 3 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:00:56 GMT content-encoding gzip x-content-type-options nosniff age 48 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3140 x-xss-protection 0 server cafe etag 17163059639670574047 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 14:00:56 GMT
GET H3	200	abg_lite.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 382A	24 KB 9 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:57:43 GMT content-encoding gzip x-content-type-options nosniff age 241 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9475 x-xss-protection 0 server cafe etag 15988442915344899701 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:57:43 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/ Frame 2C26	43 B 260 B	15ms 14ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=558&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5823350303&L4id=138371350639&S1id=22308610192&S2id=22364980590&ord=1637589704174&r=963698074774&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 85AF Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1	43 B 894 B	20ms 20ms	Image image/gif	184.30.24.241 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY_u38uQEwAQ&v=APEucNWVMdSnHnle_IiWeimBTD5ZoyO7qG3XM55v5b3rED90JLV8VODqgkwuza14GgMAJXvDWD1LAmurFvCLTtiqwUqAvVBJjb0JEdu8CQAIY9l8Z2x3w1MeotlksKouQ_EE8LPIzzKx6iaYaFxyqFF44Wnv-8wKUA Protocol HTTP/1.1 Server 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-24-241.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 22 Nov 2021 14:01:44 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 85AF Redirect Chain https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZuiyNavuihB01qP1WJQywAA https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1	43 B 894 B	31ms 31ms	Image image/gif	184.30.24.241 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY_u38uQEwAQ&v=APEucNWVMdSnHnle_IiWeimBTD5ZoyO7qG3XM55v5b3rED90JLV8VODqgkwuza14GgMAJXvDWD1LAmurFvCLTtiqwUqAvVBJjb0JEdu8CQAIY9l8Z2x3w1MeotlksKouQ_EE8LPIzzKx6iaYaFxyqFF44Wnv-8wKUA Protocol HTTP/1.1 Server 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-24-241.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 22 Nov 2021 14:01:44 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGcgBJXGIxd9HDzbpDvdHfU&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	setuid ib.adnxs.com/ Frame 85AF Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1	43 B 1006 B	12ms 12ms	Image image/gif	37.252.173.38 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY_u38uQEwAQ&v=APEucNWVMdSnHnle_IiWeimBTD5ZoyO7qG3XM55v5b3rED90JLV8VODqgkwuza14GgMAJXvDWD1LAmurFvCLTtiqwUqAvVBJjb0JEdu8CQAIY9l8Z2x3w1MeotlksKouQ_EE8LPIzzKx6iaYaFxyqFF44Wnv-8wKUA Protocol HTTP/1.1 Server 37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT X-Proxy-Origin 136.243.198.82; 136.243.198.82; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 711a51bc-6ba9-4cd3-8b01-3e993c034c43 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Cache-Control no-store, no-cache, private Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://ib.adnxs.com/setuid?entity=101&code=CAESEIkIyMxutAxCxqnXi3T4BhA&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 290 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame 85AF Redirect Chain https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D	170 B 188 B	17ms 17ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY_u38uQEwAQ&v=APEucNWVMdSnHnle_IiWeimBTD5ZoyO7qG3XM55v5b3rED90JLV8VODqgkwuza14GgMAJXvDWD1LAmurFvCLTtiqwUqAvVBJjb0JEdu8CQAIY9l8Z2x3w1MeotlksKouQ_EE8LPIzzKx6iaYaFxyqFF44Wnv-8wKUA Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache Date Mon, 22 Nov 2021 14:01:44 GMT X-Proxy-Origin 136.243.198.82; 136.243.198.82; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 27b25e9f-3034-44bf-b98d-040a93c890e6 Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDg0OTEyODkyNDc0NTI3ODgxOQ%3D%3D Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H3	200	sd us-u.openx.net/w/1.0/ Frame CD39 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPl9FYpbtzLhL8bPe5L46g0&google_cver=1	43 B 61 B	27ms 17ms	Image image/gif	34.98.64.218 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPl9FYpbtzLhL8bPe5L46g0&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLnUqNACEIG2rdgCGLyWv7cBMAE&v=APEucNUV2-BwG7XjJDJzRnBa1uNUNNdf_d8UgJIoNSq7ktkmrr0k2RDPITY9SlSgmj5FCa9rj57YAnxiT2dBGYF04svqEz7nAtnUtyHcr-P_NuVTD_TxuVYAFC2hMtW2t2FispJ5aS_74c3F5Gfr2sfxESJWZqLThQ Protocol H3 Server 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 218.64.98.34.bc.googleusercontent.com Software OXGW/16.218.0 / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT via 1.1 google server OXGW/16.218.0 vary Accept p3p CP="CUR ADM OUR NOR STA NID" cache-control private, max-age=0, no-cache content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 43 expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPl9FYpbtzLhL8bPe5L46g0&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame CD39 Redirect Chain https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWQ0NzJkNzMtYjk0My0yMTIyLWU5YzUtNjgyOTQ2MjllNDI1	170 B 188 B	17ms 17ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWQ0NzJkNzMtYjk0My0yMTIyLWU5YzUtNjgyOTQ2MjllNDI1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLnUqNACEIG2rdgCGLyWv7cBMAE&v=APEucNUV2-BwG7XjJDJzRnBa1uNUNNdf_d8UgJIoNSq7ktkmrr0k2RDPITY9SlSgmj5FCa9rj57YAnxiT2dBGYF04svqEz7nAtnUtyHcr-P_NuVTD_TxuVYAFC2hMtW2t2FispJ5aS_74c3F5Gfr2sfxESJWZqLThQ Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers date Mon, 22 Nov 2021 14:01:44 GMT content-encoding gzip server OXGW/16.218.0 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" location https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YWQ0NzJkNzMtYjk0My0yMTIyLWU5YzUtNjgyOTQ2MjllNDI1 content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 via 1.1 google
GET H/1.1	200	partner sync.search.spotxchange.com/ Frame CD39 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuXL4MBq_LsG_5aE_Rq-X8&google_cver=1 https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuXL4MBq_LsG_5aE_Rq-X8&google_cver=1&__user_check__=1&sync_id=ba03ae5d-4b9c-11ec-b520-156973b60106	43 B 548 B	23ms 23ms	Image image/gif	185.94.180.126 SPOTX-AMS
General Check archive.org Show headers Download Go to Show image Full URL https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEGuXL4MBq_LsG_5aE_Rq-X8&google_cver=1&__user_check__=1&sync_id=ba03ae5d-4b9c-11ec-b520-156973b60106 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLnUqNACEIG2rdgCGLyWv7cBMAE&v=APEucNUV2-BwG7XjJDJzRnBa1uNUNNdf_d8UgJIoNSq7ktkmrr0k2RDPITY9SlSgmj5FCa9rj57YAnxiT2dBGYF04svqEz7nAtnUtyHcr-P_NuVTD_TxuVYAFC2hMtW2t2FispJ5aS_74c3F5Gfr2sfxESJWZqLThQ Protocol HTTP/1.1 Server 185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US), Reverse DNS Software nginx / Resource Hash e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:45 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type image/gif Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Access-Control-Allow-Credentials false X-fe 92 Connection keep-alive Content-Length 43 Redirect headers Date Mon, 22 Nov 2021 14:01:44 GMT Server nginx Location /partner?adv_id=7025&uid=CAESEGuXL4MBq_LsG_5aE_Rq-X8&google_cver=1&__user_check__=1&sync_id=ba03ae5d-4b9c-11ec-b520-156973b60106 Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type text/plain Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Access-Control-Allow-Credentials false X-fe 5 Connection keep-alive Content-Length 0
GET H3	200	pixel cm.g.doubleclick.net/ Frame CD39 Redirect Chain https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i... https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YjlmYjI3YjktNGI5Yy0xMWVjLWE3OWUtMWQyMWI5ZWIwMjA2	170 B 188 B	18ms 18ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YjlmYjI3YjktNGI5Yy0xMWVjLWE3OWUtMWQyMWI5ZWIwMjA2 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLnUqNACEIG2rdgCGLyWv7cBMAE&v=APEucNUV2-BwG7XjJDJzRnBa1uNUNNdf_d8UgJIoNSq7ktkmrr0k2RDPITY9SlSgmj5FCa9rj57YAnxiT2dBGYF04svqEz7nAtnUtyHcr-P_NuVTD_TxuVYAFC2hMtW2t2FispJ5aS_74c3F5Gfr2sfxESJWZqLThQ Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Date Mon, 22 Nov 2021 14:01:44 GMT Server nginx Location https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=YjlmYjI3YjktNGI5Yy0xMWVjLWE3OWUtMWQyMWI5ZWIwMjA2 Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type text/plain Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Access-Control-Allow-Credentials false X-fe 132 Connection keep-alive Content-Length 0
GET H3	200	html_obb_rendering_lib_200_275.js Show response s0.2mdn.net/879366/ Frame 5681	169 KB 59 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/html_obb_rendering_lib_200_275.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 406b4457b753e6582999535eb520f2e7994a3dacab6b1650fe4c99010f46597a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Origin https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 20:07:40 GMT content-encoding gzip x-content-type-options nosniff age 64444 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 60223 x-xss-protection 0 last-modified Mon, 27 Sep 2021 18:44:53 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 20:07:40 GMT
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 5681	8 KB 3 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:00:56 GMT content-encoding gzip x-content-type-options nosniff age 48 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3140 x-xss-protection 0 server cafe etag 17163059639670574047 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 14:00:56 GMT
GET H3	200	abg_lite.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 5681	24 KB 9 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:57:43 GMT content-encoding gzip x-content-type-options nosniff age 241 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9475 x-xss-protection 0 server cafe etag 15988442915344899701 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 13:57:43 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fe6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=11&zMoatpos=nav&zMoatvguid=-&zMoatptype=-&zMoatsl=nav-ad-plus-leader%3FT-1000&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=436&gp=5&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=371634088549&cu=1637589703774&m=867&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=5&lb=3128&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=0&ag=14&an=0&gf=14&gg=0&ix=14&ic=14&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=14&bx=0&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=27&cd=0&ah=27&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=3&jm=-1&tc=0&fs=195794&na=922839565&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	impl_v81.js Show response www.googletagservices.com/dcm/ Frame CE7B	41 KB 17 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/dcm/impl_v81.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 17 Nov 2021 12:23:00 GMT content-encoding gzip x-content-type-options nosniff age 437924 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17189 x-xss-protection 0 last-modified Mon, 18 Oct 2021 20:08:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="ads-dcm-tag" vary Accept-Encoding report-to {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 17 Nov 2022 12:23:00 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	14ms 13ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=232&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=112648038764&t=hdn&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame 52F8	22 KB 8 KB	7ms 7ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Fri, 19 Nov 2021 12:35:14 GMT expires Sat, 19 Nov 2022 12:35:14 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 264390 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fe6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=11&zMoatpos=middle&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-middle%3FLL%7CT-1000&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=250&w=300&rm=1&fy=1050&gp=1364.328125&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=112648038764&cu=1637589703774&m=920&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1364.328125&lb=3128&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=57&cd=0&ah=57&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&jk=2&jm=-1&tc=0&fs=195794&na=1130514266&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	index.html Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	21 KB 4 KB	60ms 44ms	Document text/html	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3125bf41a896ec5c79af5e8926e90736842fa1caedd6c0ab8c5a5cae122e7d34 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html access-control-allow-origin * cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} timing-allow-origin * content-length 4179 date Mon, 22 Nov 2021 14:01:44 GMT expires Tue, 23 Nov 2021 14:01:44 GMT cache-control public, max-age=86400 last-modified Tue, 17 Aug 2021 15:22:54 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
POST H2	200	view googleads4.g.doubleclick.net/pcs/ Frame FB71	0 571 B	94ms 56ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwp0oM2bXzIjmy2UotbUaOQ7MFBdKBu7eBaMHvHN86CswTAS218o0kyVOf_n28t7rRBN89wE50IyvJXFBiQypnGgr7zMlUuQ5V9Bp5Bu52k2mHY3Ca073eygVsjV8HBHEoNKIXvsNAaEi8JIaaTRdmA3FaUStnmLN9YpFSHcz5WdrSF3hzY4Xnc7KFtnzTD8OpM0gDtIT-lGAS6i0E-j-ARkn1-qehzPgQmpvJ_rPtGaIgHP-9Ix6GdXh3SI_hCBnEnb8SBa9IWNyFD19XfoSn4BtkVk4-SmqNFjMdiIbk_aeHffmYd60PZ4qvEjjJRY217B3NAYYg3b-1bknNy74VscdWLLZiZTo6hUpdvenXLpuuFgu3BW8-oQkItc5qQbd10h2lyz8TGWUWBWZyJG9znmcMHBnJ5e0akareImYn1SJr1wotkMwoRXon458PPL7_tGznk0XD_jYZtf9TDbGNcIpIhfxBi7eEH4GD2zJKPReB1Kzheuce483tqDsd5I4G0rwnuFMqt_TRsONwsKGOjNk2Ul-oO-7Q3vJZ8k8Hj2EHigho60luMTUkqMRa5tPb87xu_R6LNF4_9Rk1688yohTtiVN83tSMZ99oBKkl5z6tyxC5g0ptP79vhkwGxF_dHFgArhrb9CcR6UHr-7BXhUd8ROLfezVkIA_m0OQs86vNzJ45OJJN9ADDQx7LTMv---OVLrwHbK5mYOpBbwEWCoJ-1_-2BP-2MKVGLIrS13iXxJI2VB5bBhMQRPkYh1Rg1P7RGOFUMAnZbNWk1Etc9Ae33pZWoU4hLtUWbAd1CwCgeLQkm7SlXaK-lNDKrMJAL_msxZ8cuEKQylBDGcMeI8r6rhOIY7CcZUPCAg6f8Sv12CrkhjNSUChntnH6zDDmYq6VzZvVIpTuF_9-VuJO-UvRvM_w-YRt1o_-WY3I8E1wCZfvT2s4UHL3fBq7noxsNBzTDcbLFSP1_vbKI3lMf4-1S7wWUDI6-Dek1u-Z_uGpGCmnW5K6wuw4ijIRxZceOGNA_seOiLhpmu53D4JCB6rVzJA1jeNX9NltMz7WQOIIjpYLS5vLG-qptXr6shGDmxxssCw17yhnqkLTyNJd73j0jEQzfY1qWgL5ywfEFswAvPY4IQUoaWlvbFAdIZyonpxONEXMTTg&sai=AMfl-YSW48I0o1Kh1e-Y4fPu9_SzusduMw2_88XXsRiIjgFivDqS8efWIyE5X8B1rJkOJXekR9_kUykkdMOEBGGi2bMop1Q_R9gD5mRhlLqP4pBP4M4gBKJJeS-jpqQ6r2aLXElqRdAj1ak102B_W7-5r3yP2X-8OtlGLl0WiOw&sig=Cg0ArKJSzMrpGt8gbOl9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=217&cbvp=1&cstd=211&cisv=r20211111.34507&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version date Mon, 22 Nov 2021 14:01:44 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	13ms 13ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=17&fi=1&apd=34&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=974567281937&t=meas&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=top&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-plus-top%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	14ms 14ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=17&fi=1&apd=34&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=974567281937&t=fv&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=top&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-plus-top%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	15ms 15ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=17&fi=1&apd=34&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=974567281937&t=nht&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=top&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-plus-top%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	14ms 13ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=30&fi=1&apd=47&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=974567281937&t=hdn&os=1&fi2=0&div1=0&ait=0&gpt_target_pos=top&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-plus-top%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	14ms 13ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=13&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=997648044137&t=meas&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=bottom&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-bottom%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	15ms 14ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=13&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=997648044137&t=nht&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=bottom&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-bottom%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	index.html Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	21 KB 4 KB	43ms 43ms	Document text/html	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c7a8de185b741aa75ad4248d7490c7fc4d208264b1fb1905cd899f150920ad12 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html access-control-allow-origin * cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} timing-allow-origin * content-length 4012 date Mon, 22 Nov 2021 14:01:44 GMT expires Tue, 23 Nov 2021 14:01:44 GMT cache-control public, max-age=86400 last-modified Tue, 17 Aug 2021 16:47:46 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
POST H2	200	view googleads4.g.doubleclick.net/pcs/ Frame 382A	0 61 B	58ms 58ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvkwZk77fI6bsGuRFXbXFO7_GuC2FsoVhC2KbkIj1qiHeAyrpSJHfF6bL-5WDzSc15_xV9b6F_ApYMeAEHuEOjdVMZv-Ou2k3zfSO91_dX91DsGIyy_FuNQTUXLP7ZCJcYr68E7wKclLXOtmUZeVb3FtU4TTdz_8XpN8Ys2sF9Yw0Hce7EgPwcjN_x3y86n2kh6PaqOUTJHTl3c2q99rFG8pu66F44Gh_P2TuJQZNjI0ohH-aoIDuqnEGupkZmboRaU9Dx5K0HM1PcVS6ScRg-ftnhqGEA5lUvasWYjYdfqOQ7Wbcg22AOZwlRkrZb_3LJyycU5xAj7WKQJfmDRTLMJM-NWOMgGhS204iw1iBExW-C3eQdzLw38FLxdW5PBkNb_OdHIPvEfVrEh5XYsgoUuIc0NDm-fK-CesyygWbDRrG7h53P20SdYv7q3-inSx0-0FMtUu7gemhnFcT8D9-tvLoHbM_o9jpVjkgMUADTKlZRFFA1zOAHhnJDwMyv1v_YOaBD49aT_uWe-uCklUTw89K_hJ6dLxf9JV-lloXZyQY0K8nqZL3aQ8oZgGvJwR_E89btxd2qES4TGibjhshlVIOHmZ4JsecaiI7ZnwXgeZA73JKGmVlWZEEU8R-0LjDDredl7P6kiXOhzcf3bKy-8fExcfCHNGs_h9lfJj_2h_pJoswolApRTMfRNw6s75UeAQ7oCZfY7UgXRZPT0ryJxB41wxF1VFjBXTZtqA-wpmZyJem2yzjjtiXjitHFWXyOZUHQ3YQJqU4Hik6capQ8QCebjCK5RCqJPVQ-q6UgCdJ07JGAPu5dV4sXswNWtcu2gXIOv8rX-ARIJ5nG983XUg-JS2rvCjlAhm_4Vwy5-cIb1jVj32ya898UISwusk1mNe1h6iIONaDymW6sxAF4bC23MHy00U6JenW2QgQfnraqoCC__xhqs87fV1ZdYP5XzG_sUDh_uE4BTt8IqYfeISF9tUjErwDtVb6zR7KV9Tc34jsF9DwZkWwZOdeeD_zAqzMHe5enRLUzi2fjguoYAgueqEes1GSLo5ZK9QpEToAEkt0XLFoWD-KGItfyzwRlFt7MHpDARfYbDwfRiFK-ItwPGkDH-rXHLfKTVWNhaHsYcXWy3HOHU1DzzO1vd-RRiTPnXOg&sai=AMfl-YSxRLaovEvHzlks_MNtblK-huc5_SEsJzvuv9FueQykRPfZ0xUnBOP2s8cevwSofJ3jpcMGg2HcaC7B9N-wcFsM6Poz-Um_NLBo80ltKGFXdKqVIYtNfuQ8DZ6i4zCj5Kq8pqk38tUub_ZvDUyJ7Mk7tPJFf29KYwkDLyE&sig=Cg0ArKJSzC_NECqC9lw6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=196&cbvp=1&cstd=192&cisv=r20211111.09142&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version date Mon, 22 Nov 2021 14:01:44 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	index.html Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	2 KB 520 B	45ms 45ms	Document text/html	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0bd6de11c4a10cb46149f6a4a5ef2268b410f38b16c83468bd6905c280892fad Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html access-control-allow-origin * cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} timing-allow-origin * content-length 493 date Mon, 22 Nov 2021 14:01:44 GMT expires Tue, 23 Nov 2021 14:01:44 GMT cache-control public, max-age=86400 last-modified Mon, 18 Oct 2021 09:39:09 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
POST H2	200	view googleads4.g.doubleclick.net/pcs/ Frame 5681	0 61 B	56ms 56ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXtKYmcQ1DwJNJF9WF71mYPTMyG_wXyC2NGJiiwtCih3fV4Osa0V2icm1Kq0iKquorCqwaKRSVNtunFlXN0oFguwD9rdKOD9M0sQYTyOAXYG_haknd3eBlumbfmX93zHHY001bEShLVY37Y9Fj5bFSaxyKlCIXo5TpL4-TDc4OidoUu4ohLd_LzIx9Ykad74qqOGCUJGV4mReZvQ53b67gVrmZScDKBbAIbEgthDHllgb6VczWMyDxhqlZHW79FBKLBGdU8CGhT7-bs5CUw4-YjRKEwEABg5bss3x5PUjujB4mBLHyOPAGvxfMsYchqqmtaTY0rC0fcSShyf56De9zA_DdtXhIrOo3VyUHIh7ne0ygd4QnyI9xzFqQVbLMres7JYfoMLtbI5_INoedoodRCA1-beFYAzwH5Kirv74HTCifieDMpHeW3xRR6qrgz7kRRoy3kMCN6qYRF-3nM2YfDvOL6CQETjML2fVQpCrvKNTcyDOdWDd1wb23Z8YCwYOAdL2DzgZ9XI9zdOV2_7pSqGJIDVmAjtYMdNFm_LNuCJtkfVjGKIDwmOn-vRdUflyfhP-XNAAhU9HEmSlgrqcs0zzVxp_rnG_kPMrd1smbGIgcXH1IDCGAxxDjBwnLsDmFsnPGJBaSTmCYqz5IGD8SVL10RptO-lP-2kvrqVUTVX5r3-2hvUeuXDY2d5AiXyP-WC5mmiMobJb53J3lITwl57raBAsFM_lzkhTeqg5XipBRX2LvJ2hpyzjg78XvvZS93b_YBbMuOYReDPMV33nebo6NFt_UoqQNCqkz3ssZCSVw2FsnrhpUOhQPDRtKHcMemFCYIIl8Vn7cStlJlQRI7pzJzd4bzTkzMDN7z3ZwdJh_H1HiN7_UKG7lpv9Ub12eBmpwVHbNbToB2r9m_1yDlU9Ej3met2iicn7_29_hT0ccDc21KmJUIFODO69qm2AIw6sfy94lSNuEIchyfEZovK2Y0ZGEyoDUSP-W-lx6Foc94zbXmAyRNL3UgZhOlu1JpQ2SEhcWfkCaBfPs9ovUmUxT2WKj-LsYJY2lwmXDOW2nTD3G7lwhcBJbo6udNUjn5qLBgzquo5zKXaggPGkYMhboNYkB5MkeDlLJyLT8CvI9vbrnz-efO-picLBz_qYLwFzgDJL1Jkx_IsNP0C4IadXDbLpgR7RaHU1NW9lGwqVv1SJumFiIY7dkcsJoBdMo4U1qhglWlJiz5SlP0qWpJk1t7hCyH5Fph8NcAZURHG_m4e9yFXW-7RFkb7s7AeQxdz1BX3p0YkMHVdCKjCPwGmg&sai=AMfl-YTnb9rUJ3IssCvknZUqOFldsYX4kIyYjDpSDEVlvr99zgOHbP3YkqHONzbYWMGUuP3UixwegYvi4NFt9SQQXdoZ-PLREWmHMAuWlVkNOeB_XlEh5paZ6sNAqg0Rx0Ya79aoJWOOAynXwolCOjDWWJDXZ4vRtQ&sig=Cg0ArKJSzFDswJKI4ibdEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=163&cbvp=1&cstd=158&cisv=r20211111.97254&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version date Mon, 22 Nov 2021 14:01:44 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	B26086838.311141236;dc_ver=81.235;sz=728x90;u_sd=1;dc_adk=3047537733;ord=1fuh74;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIvlJx6KbYYuFKumV7_UPtfyK8A7eq4ykZNGBvtmA... Show response ad.doubleclick.net/ddm/adj/N738225.3665442DV360/ Frame CE7B	43 KB 22 KB	41ms 40ms	Script text/javascript	142.250.185.70 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ad.doubleclick.net/ddm/adj/N738225.3665442DV360/B26086838.311141236;dc_ver=81.235;sz=728x90;u_sd=1;dc_adk=3047537733;ord=1fuh74;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIvlJx6KbYYuFKumV7_UPtfyK8A7eq4ykZNGBvtmADsCNtwEQASD3u8eDAWCVgoCAuAegAfqa3tsByAEJqQIcIRu3xe6yPqgDAaoE4QFP0B8OFNH-QJRyzJset_i_iOmK0hO59YtbQm45WZ61euDSrcdau-GgpixJuM6vDjUNg1DRK2wJah9B5LMt8QWVA-15n4rbSNT4QLf51O2bYDMX74SMp2DNYy1LzBKcjZkx5LLWatW77YJF38KToYnm7zyRTvls_l8RNNc85olnZxJgnQjd0EMCnKKsj7oMNUMIOP-bHkQNFBMa1vTLiKUOPlPq8FLHhDulkcvrMIJJb5WAXu0f6bJo3uUgfXDrBOGT5a9SMGDArEdNpTpA2lg__bkbSjDSYW2g4zKVKGCmZhHABNaOo6zPA-AEA5AGAaAGTYAH7uShpAKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgOYCwHICwGADAGwE6CoqQ3YEwrYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo9iFoekptSkOwjKnn4HIQU2iAqQ%26sig%3DAOD64_2yBVCtHzB2y8sKTyu-Wt6Sb5tKAw%26client%3Dca-pub-8820362605711196%26dbm_c%3DAKAmf-AqpNSQ8VeWOeoS-0jBIaxr6WDQ8au6ogpJoPoir6OuZTlVag7qcMTqSuodMylBOHmF6RdXeVdmFC_gPnesh6U91eLWcZ-XPgUHqKSFiKJckRcTvgr6Da8agRwknPF1JoYYh33A_R11hDQwl81YHM_fOSeV3g%26cry%3D1%26dbm_d%3DAKAmf-Ds3UajM5vw882bRBUVXNk2Z9m2ZL98aljYui2hlDfdHDXT4GROmh4YCFK1nkmlMFfMLu-aT21wGwd3TOUfv-8l-yByIS1sYgDuKAIVYzofrKE9Pmzropc1gBsKy9s-ST0uncezI_UN-iCt_8UX4m3q9bgSOiAaiIfGqT5L9yyAe7SsLo-tcyhdI9Koik5nNwAu9dme8MJljkjzKVc-Kc0xhA-RxFe3yTXJVGfzBkhqf2Tr91Kje-sWOFWeTsfHAmhdRaHhBeFtZT27mL5TUPjWWcdGVQBEuYY-Y2RTgpTMThHn7D2o93A6Uq8cu5sqRskXzcg7Ad7sf3nUie3VkhFYL64qIdiinn-qW6mmdv6l3qhYz5UWQfwbL7VLwcQkocX2I_iwWNHVzpKf4kbYfM121Tzq9wIbLwCtQUfVtR9OsAJIzogJkBt_LKUEUdcRWdagQ3eGW9XdmqtXujQCv-mRWcw5NoHJSW4-WS-YgemC8N14fo2zb0iUcG9sVMIo9emQ1wml2IFuXL_OhZdA3H5QnGIJNA%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F$0;xdt=1;crlt=l7)K8ZFfJI;sttr=135;prcl=s Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.70 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f6.1e100.net Software cafe / Resource Hash 1ff2cf5b704283eba50ee16dcf84aea38d452960536ebab70f523084cd936694 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22386 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	33ms 32ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fe6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=top&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-plus-top%3FLL%7CT-1000&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=600&w=300&rm=1&fy=1050&gp=421.796875&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=974567281937&cu=1637589703774&m=1128&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=421.796875&lb=3128&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=0&ag=17&an=0&gf=17&gg=0&ix=17&ic=17&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=17&bx=0&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=34&cd=0&ah=34&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=3&jm=-1&tc=0&fs=195794&na=1072679148&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:44 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:44 GMT
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame FB71	41 KB 15 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 19 Nov 2021 12:35:12 GMT content-encoding gzip x-content-type-options nosniff age 264393 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Sat, 19 Nov 2022 12:35:12 GMT
GET DATA	200 OK	truncated / Frame FB71	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0adfd8dc72c469b00577a5874d23da38c0d622ad3832b5345a7eafa722ff36c1 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 382A	41 KB 15 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 19 Nov 2021 12:35:12 GMT content-encoding gzip x-content-type-options nosniff age 264393 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Sat, 19 Nov 2022 12:35:12 GMT
GET DATA	200 OK	truncated / Frame 382A	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b51f957297480448b537e53a656ed39be18d2d7d4b1790ad792986e15fda7479 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 5681	41 KB 15 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 19 Nov 2021 12:35:12 GMT content-encoding gzip x-content-type-options nosniff age 264393 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Sat, 19 Nov 2022 12:35:12 GMT
GET H3	200	cookie_push_onload.html Show response pagead2.googlesyndication.com/pagead/s/ Frame E3D4	1 KB 749 B	7ms 6ms	Document text/html	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" timing-allow-origin * cross-origin-resource-policy cross-origin vary Accept-Encoding date Mon, 22 Nov 2021 13:26:12 GMT expires Tue, 23 Nov 2021 13:26:12 GMT content-type text/html; charset=UTF-8 etag 48472445140208031 x-content-type-options nosniff content-encoding gzip server cafe content-length 724 x-xss-protection 0 age 2133 cache-control public, max-age=86400 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET DATA	200 OK	truncated / Frame 5681	219 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2a68da9ad17f0a3149e40d5940b12fb22d26d7cc64c70f071401d5f4e5372cea Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	15ms 14ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=218&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=997648044137&t=hdn&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=bottom&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-bottom%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:45 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	16ms 15ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fe6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=bottom&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-bottom%3FLL%7CT-1000&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=250&w=300&rm=1&fy=1050&gp=2056.953125&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=997648044137&cu=1637589703774&m=1141&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=2056.953125&lb=3128&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=13&cd=0&ah=13&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&jk=2&jm=-1&tc=0&fs=195794&na=2025287133&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame CE7B	8 KB 3 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:00:56 GMT content-encoding gzip x-content-type-options nosniff age 49 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3140 x-xss-protection 0 server cafe etag 17163059639670574047 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 06 Dec 2021 14:00:56 GMT
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame CE7B	0 23 B	62ms 47ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv4AzFpSHNX254aWNye0_U9b7w3HqHYBVykF8c9aIcoe3J1HZLaju-J-QeOW44sAfFYsO4IMG9hdXSy2KlJrmLrssaQMqWt-9SLerwEroi4szYlJDbWYDmHob0SLDs0Ag-C5-zwVJyTICo8XGqCaAkc&sig=Cg0ArKJSzEhFOOcZsfo2EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211111.85387&adurl= Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N738225.3665442DV360/B26086838.311141236;dc_ver=81.235;sz=728x90;u_sd=1;dc_adk=3047537733;ord=1fuh74;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIvlJx6KbYYuFKumV7_UPtfyK8A7eq4ykZNGBvtmADsCNtwEQASD3u8eDAWCVgoCAuAegAfqa3tsByAEJqQIcIRu3xe6yPqgDAaoE4QFP0B8OFNH-QJRyzJset_i_iOmK0hO59YtbQm45WZ61euDSrcdau-GgpixJuM6vDjUNg1DRK2wJah9B5LMt8QWVA-15n4rbSNT4QLf51O2bYDMX74SMp2DNYy1LzBKcjZkx5LLWatW77YJF38KToYnm7zyRTvls_l8RNNc85olnZxJgnQjd0EMCnKKsj7oMNUMIOP-bHkQNFBMa1vTLiKUOPlPq8FLHhDulkcvrMIJJb5WAXu0f6bJo3uUgfXDrBOGT5a9SMGDArEdNpTpA2lg__bkbSjDSYW2g4zKVKGCmZhHABNaOo6zPA-AEA5AGAaAGTYAH7uShpAKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgOYCwHICwGADAGwE6CoqQ3YEwrYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo9iFoekptSkOwjKnn4HIQU2iAqQ%26sig%3DAOD64_2yBVCtHzB2y8sKTyu-Wt6Sb5tKAw%26client%3Dca-pub-8820362605711196%26dbm_c%3DAKAmf-AqpNSQ8VeWOeoS-0jBIaxr6WDQ8au6ogpJoPoir6OuZTlVag7qcMTqSuodMylBOHmF6RdXeVdmFC_gPnesh6U91eLWcZ-XPgUHqKSFiKJckRcTvgr6Da8agRwknPF1JoYYh33A_R11hDQwl81YHM_fOSeV3g%26cry%3D1%26dbm_d%3DAKAmf-Ds3UajM5vw882bRBUVXNk2Z9m2ZL98aljYui2hlDfdHDXT4GROmh4YCFK1nkmlMFfMLu-aT21wGwd3TOUfv-8l-yByIS1sYgDuKAIVYzofrKE9Pmzropc1gBsKy9s-ST0uncezI_UN-iCt_8UX4m3q9bgSOiAaiIfGqT5L9yyAe7SsLo-tcyhdI9Koik5nNwAu9dme8MJljkjzKVc-Kc0xhA-RxFe3yTXJVGfzBkhqf2Tr91Kje-sWOFWeTsfHAmhdRaHhBeFtZT27mL5TUPjWWcdGVQBEuYY-Y2RTgpTMThHn7D2o93A6Uq8cu5sqRskXzcg7Ad7sf3nUie3VkhFYL64qIdiinn-qW6mmdv6l3qhYz5UWQfwbL7VLwcQkocX2I_iwWNHVzpKf4kbYfM121Tzq9wIbLwCtQUfVtR9OsAJIzogJkBt_LKUEUdcRWdagQ3eGW9XdmqtXujQCv-mRWcw5NoHJSW4-WS-YgemC8N14fo2zb0iUcG9sVMIo9emQ1wml2IFuXL_OhZdA3H5QnGIJNA%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F$0;xdt=1;crlt=l7)K8ZFfJI;sttr=135;prcl=s Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame CE7B	41 KB 15 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 19 Nov 2021 12:35:12 GMT content-encoding gzip x-content-type-options nosniff age 264393 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Sat, 19 Nov 2022 12:35:12 GMT
GET H3	200	IPNS_Prog_728x90.png s0.2mdn.net/8198427/ Frame CE7B	94 KB 94 KB	8ms 8ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/8198427/IPNS_Prog_728x90.png Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 467bce6ccb3da678b7b8384221e2296cf158720ce2bcac9fda01b73a5b9da909 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 22:39:57 GMT x-content-type-options nosniff age 55308 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 96418 x-xss-protection 0 last-modified Tue, 10 Aug 2021 09:25:00 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 22:39:57 GMT
GET DATA	200 OK	truncated / Frame CE7B	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8f591c5493c3934bb5f76a8ecf80fda38c901319937dd9d76ef5766200e28ef5 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H3	200	gwdpage_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	55 B 80 B	8ms 7ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdpage_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:28:23 GMT x-content-type-options nosniff age 27202 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 55 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:28:23 GMT
GET H3	200	gwdpagedeck_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	731 B 262 B	9ms 8ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdpagedeck_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:50:51 GMT content-encoding gzip x-content-type-options nosniff age 25854 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 234 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:50:51 GMT
GET H3	200	gwdgooglead_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	24 B 49 B	10ms 8ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdgooglead_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:11:13 GMT x-content-type-options nosniff age 10232 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:11:13 GMT
GET H3	200	gwdimage_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	281 B 186 B	10ms 9ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdimage_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:17:13 GMT content-encoding gzip x-content-type-options nosniff age 9872 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 158 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:17:13 GMT
GET H3	200	gwdtaparea_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	157 B 143 B	13ms 10ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdtaparea_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:21:20 GMT content-encoding gzip x-content-type-options nosniff age 9625 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 115 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:21:20 GMT
GET H3	200	gwdattached_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	26 B 51 B	13ms 10ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdattached_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:00:20 GMT x-content-type-options nosniff age 32485 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 26 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:00:20 GMT
GET H3	200	googbase_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	400 B 303 B	16ms 13ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/googbase_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 17:36:43 GMT content-encoding gzip x-content-type-options nosniff age 73502 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 275 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 17:36:43 GMT
GET H3	200	gwd_webcomponents_v1_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	21 KB 6 KB	14ms 11ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwd_webcomponents_v1_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 630dcb1aea14b0b32672353c6718f225a51122da1e170c35185ed4177b3489cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 15:51:08 GMT content-encoding gzip x-content-type-options nosniff age 79837 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6269 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 15:51:08 GMT
GET H3	200	gwdpage_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	3 KB 1 KB	23ms 21ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdpage_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3702675bb100b35f2cc13c2d7e830a1abb3d645ddeb6a2155be81d777d21dfa8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:35:02 GMT content-encoding gzip x-content-type-options nosniff age 30403 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1307 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:35:02 GMT
GET H3	200	gwdpagedeck_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	8 KB 3 KB	20ms 18ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdpagedeck_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3cc9c19f7f03042ecb970557d5622cdd897a7dfc3ba92877137824f7ce88efde Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:36:36 GMT content-encoding gzip x-content-type-options nosniff age 26709 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3130 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:36:36 GMT
GET H3	200	Enabler_01_246.js Show response s0.2mdn.net/879366/ Frame 42E6	116 KB 39 KB	17ms 15ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/Enabler_01_246.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 19:58:05 GMT content-encoding gzip x-content-type-options nosniff age 65020 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40237 x-xss-protection 0 last-modified Wed, 30 Jun 2021 20:54:51 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 19:58:05 GMT
GET H3	200	gwdgooglead_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	13 KB 4 KB	22ms 20ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdgooglead_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a3f7b457ebebc60c111e92d8dc5d497b4c7fca36bcf99cffb9a1705f47424676 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:42:37 GMT content-encoding gzip x-content-type-options nosniff age 26348 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4411 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:42:37 GMT
GET H3	200	gwdimage_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	5 KB 2 KB	18ms 15ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdimage_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 00e3bc05f59be2a1faacba16a7c0fba7de267a60f2e88c04789e4ffe0dfb6056 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:00:20 GMT content-encoding gzip x-content-type-options nosniff age 32485 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2004 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:00:20 GMT
GET H3	200	gwdtaparea_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	4 KB 2 KB	20ms 18ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdtaparea_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d66c408f2d22f32c480961298e6fba83ca59fe57386f9e6726a47c27553aad90 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:00:20 GMT content-encoding gzip x-content-type-options nosniff age 32485 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1809 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:00:20 GMT
GET H3	200	gwdgpadataprovider_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	3 KB 1 KB	19ms 17ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdgpadataprovider_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 11084de664d888933874102638926c6686af22a88f1805fc3d4f55ba91b2d816 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 16:12:06 GMT content-encoding gzip x-content-type-options nosniff age 78579 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1286 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 16:12:06 GMT
GET H3	200	gwdattached_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	1 KB 624 B	19ms 17ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdattached_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3b1b78dc0bec6c4c5e65036a6d67c15a91ae2fc807f61ddab5ddccc3483cb9c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:00:20 GMT content-encoding gzip x-content-type-options nosniff age 32485 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 587 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:00:20 GMT
GET H3	200	gwdtexthelper_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	7 KB 3 KB	18ms 16ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwdtexthelper_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 35b384bb05910ed7d48bd862cd68e26612295c2019ae64a59984908292fd5bad Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:32:18 GMT content-encoding gzip x-content-type-options nosniff age 26967 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2873 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:32:18 GMT
GET H3	200	gwddatabinder_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	5 KB 2 KB	17ms 16ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwddatabinder_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 414eef74ac6306127645beddc4f34f59a6ea3994e410f188481d736b01ee4b65 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:46 GMT content-encoding gzip x-content-type-options nosniff age 27059 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2321 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:46 GMT
GET H3	200	gwd-dynamic-binders.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	26 KB 10 KB	14ms 13ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/gwd-dynamic-binders.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1b7dae0db48b4096db0d72ceb798d500974825ca5eb1700d7b2a88d76591e360 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 15:46:07 GMT content-encoding gzip x-content-type-options nosniff age 80138 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10519 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 15:46:07 GMT
GET H3	200	gwdpage_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	55 B 88 B	14ms 11ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdpage_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:23:41 GMT x-content-type-options nosniff age 9484 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 55 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:23:41 GMT
GET H3	200	gwdpagedeck_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	731 B 271 B	19ms 8ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdpagedeck_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 17:39:24 GMT content-encoding gzip x-content-type-options nosniff age 73341 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 234 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 17:39:24 GMT
GET H3	200	gwdgooglead_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	24 B 58 B	18ms 7ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdgooglead_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 15:42:34 GMT x-content-type-options nosniff age 80351 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 15:42:34 GMT
GET H3	200	gwdimage_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	281 B 195 B	19ms 7ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdimage_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:02:24 GMT content-encoding gzip x-content-type-options nosniff age 32361 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 158 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:02:24 GMT
GET H3	200	gwdtaparea_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	157 B 152 B	21ms 9ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdtaparea_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:02:24 GMT content-encoding gzip x-content-type-options nosniff age 32361 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 115 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:02:24 GMT
GET H3	200	gwdattached_style.css s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	26 B 60 B	18ms 8ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdattached_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 14:49:37 GMT x-content-type-options nosniff age 83528 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 26 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 14:49:37 GMT
GET H3	200	googbase_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	400 B 313 B	21ms 11ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/googbase_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:18:50 GMT content-encoding gzip x-content-type-options nosniff age 9775 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 275 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:18:50 GMT
GET H3	200	gwd_webcomponents_v1_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	21 KB 6 KB	20ms 10ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwd_webcomponents_v1_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 630dcb1aea14b0b32672353c6718f225a51122da1e170c35185ed4177b3489cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:02:25 GMT content-encoding gzip x-content-type-options nosniff age 32360 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6269 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:02:25 GMT
GET H3	200	gwdpage_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	3 KB 1 KB	21ms 10ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdpage_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3702675bb100b35f2cc13c2d7e830a1abb3d645ddeb6a2155be81d777d21dfa8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 15:58:09 GMT content-encoding gzip x-content-type-options nosniff age 79416 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1307 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 15:58:09 GMT
GET H3	200	gwdpagedeck_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	8 KB 3 KB	22ms 12ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdpagedeck_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3cc9c19f7f03042ecb970557d5622cdd897a7dfc3ba92877137824f7ce88efde Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:13:26 GMT content-encoding gzip x-content-type-options nosniff age 10099 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3130 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:13:26 GMT
GET H3	200	Enabler_01_246.js Show response s0.2mdn.net/879366/ Frame A9C3	116 KB 39 KB	19ms 8ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/Enabler_01_246.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 19:58:05 GMT content-encoding gzip x-content-type-options nosniff age 65020 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40237 x-xss-protection 0 last-modified Wed, 30 Jun 2021 20:54:51 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 19:58:05 GMT
GET H3	200	gwdgooglead_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	13 KB 4 KB	23ms 16ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdgooglead_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a3f7b457ebebc60c111e92d8dc5d497b4c7fca36bcf99cffb9a1705f47424676 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:52:11 GMT content-encoding gzip x-content-type-options nosniff age 7774 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4411 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:52:11 GMT
GET H3	200	gwdimage_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	5 KB 2 KB	22ms 15ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdimage_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 00e3bc05f59be2a1faacba16a7c0fba7de267a60f2e88c04789e4ffe0dfb6056 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:08:54 GMT content-encoding gzip x-content-type-options nosniff age 10371 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2004 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:08:54 GMT
GET H3	200	gwdtaparea_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	4 KB 2 KB	23ms 16ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdtaparea_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d66c408f2d22f32c480961298e6fba83ca59fe57386f9e6726a47c27553aad90 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:02:25 GMT content-encoding gzip x-content-type-options nosniff age 32360 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1809 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:02:25 GMT
GET H3	200	gwdgpadataprovider_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	3 KB 1 KB	21ms 15ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdgpadataprovider_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 11084de664d888933874102638926c6686af22a88f1805fc3d4f55ba91b2d816 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 16:16:15 GMT content-encoding gzip x-content-type-options nosniff age 78330 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1286 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 16:16:15 GMT
GET H3	200	gwdattached_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	1 KB 625 B	18ms 14ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdattached_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3b1b78dc0bec6c4c5e65036a6d67c15a91ae2fc807f61ddab5ddccc3483cb9c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:02:25 GMT content-encoding gzip x-content-type-options nosniff age 32360 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 587 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:02:25 GMT
GET H3	200	gwdtexthelper_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	7 KB 3 KB	18ms 13ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwdtexthelper_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 35b384bb05910ed7d48bd862cd68e26612295c2019ae64a59984908292fd5bad Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:29:27 GMT content-encoding gzip x-content-type-options nosniff age 27138 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2873 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:29:27 GMT
GET H3	200	gwddatabinder_min.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	5 KB 2 KB	18ms 14ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwddatabinder_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 414eef74ac6306127645beddc4f34f59a6ea3994e410f188481d736b01ee4b65 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:02:25 GMT content-encoding gzip x-content-type-options nosniff age 32360 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2321 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:45 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:02:25 GMT
GET H3	200	gwd-dynamic-binders.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	26 KB 10 KB	18ms 14ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/gwd-dynamic-binders.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1b7dae0db48b4096db0d72ceb798d500974825ca5eb1700d7b2a88d76591e360 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 17:38:26 GMT content-encoding gzip x-content-type-options nosniff age 73399 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10519 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 17:38:26 GMT
GET H3	200	style.css s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	916 B 429 B	17ms 13ms	Stylesheet text/css	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a53dac82484cdbb9a8e6f0ac5678bc54565328f423a172dd12addd510cbad9e2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:11 GMT content-encoding gzip x-content-type-options nosniff age 27094 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 392 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:11 GMT
GET H3	200	Enabler_01_247.js Show response s0.2mdn.net/879366/ Frame 5EA1	118 KB 40 KB	12ms 11ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/Enabler_01_247.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 15:50:37 GMT content-encoding gzip x-content-type-options nosniff age 79868 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 41099 x-xss-protection 0 last-modified Mon, 27 Sep 2021 18:45:07 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 15:50:37 GMT
GET H3	200	gsap_3.5.1_min.js Show response s0.2mdn.net/ads/studio/cached_libs/ Frame 5EA1	60 KB 24 KB	89ms 87ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff age 0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24155 x-xss-protection 0 last-modified Mon, 31 Aug 2020 21:23:17 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	preloadjs_1.0.0_min.js Show response s0.2mdn.net/ads/studio/cached_libs/ Frame 5EA1	64 KB 16 KB	91ms 89ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2fe88ce75cf4a9dd4997e04ca59e6d3e09a8116c9c5d3d2c6237e34e1a1f38e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff age 0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16580 x-xss-protection 0 last-modified Tue, 19 Nov 2019 16:57:36 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=0 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	logic.js Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	6 KB 1 KB	17ms 15ms	Script text/javascript	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/logic.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cef70ba63e35e828f3e2aaf7b52146effee2379da3a656d702bca2078c108238 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 20:51:19 GMT content-encoding gzip x-content-type-options nosniff age 61826 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1385 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 20:51:19 GMT
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame 8A70	22 KB 8 KB	7ms 7ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Fri, 19 Nov 2021 12:35:14 GMT expires Sat, 19 Nov 2022 12:35:14 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 264391 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame 2D80	22 KB 8 KB	7ms 6ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Fri, 19 Nov 2021 12:35:14 GMT expires Sat, 19 Nov 2022 12:35:14 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 264391 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame CE72	22 KB 8 KB	6ms 6ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Fri, 19 Nov 2021 12:35:14 GMT expires Sat, 19 Nov 2022 12:35:14 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 264391 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	48ms 48ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021111601&jk=4417576961676516&bg=!ra6lrurNAAZQLpa_UC47ACkAdvg8WnrBwmg5RffXZXFYUhO9Wt3Bp43gD25XksyA8KtGYa_FExkrRwIAAAJ9UgAAANVoAQcKADJCEccVwmtkklLbjKS4Nn4VZaw5-j6QkAgDgZhDnoBdbp06CoUaE2PTdN4uJqzpU-KWT5kCh1JEyehwSJdjXyIYG3kLDj8ZRS_a2F9feU6ag4jSRkCX8AchTkuE2WCaIQ2Jb22mg4t-EfWiKZZpV82R1B-Mgv7IRjBy3feeeVMuKu_KMo-GIytmBECIH5xKf-AfJL-ua8EfW53rT9aKQO_9RUDfMpzFro0Dj_QdHa-gbm3DZLmWuNbm4ODpFUrrlFRK39CbeedwNSpzVJBSN2uIGphk3Bryv03mZbMbiz49wv3v7ZA3AH3k99HmZ9sRiGVEn0t1iIF49XJIMKdzar-9G3JFuxnoaFotFv_l2bzUUPbssZTeO_6fEgEUb6NPcAbEICvN21dGNfk5_0VzFhEEJqFMyjn0Oged7C_2v4dwGfpUKoCOaSPhImAUWkObeNm41F-G3bCle1HTaZQucelihgUjC2lnu39gjz53zAyuACSYfQY3FWd88Z7UMaM7JEp-moNxCuHz9xeDBogXWknlUhTvKeAvOUgvhdOdPTAdhV-rk1Y9EbkFj1d9faElhUS5W0dme1rLrmcs9xsZUWjiAAIWlnM1nPvv4SKqD5-ZGN6Af_6x_sFYDcYnC5wrb3CzA4qDKHumZNMvT5WAw8zVw_FI-3cRGJx7YycyJbORLbrie-8vSt2ASgtMxuXZBzlfFRILUJeYS56U-_HsqOfizg_A5RNo_IkWlkgpz5fnpU_-Ce6g5Wr8eTff1GeKqQLXMrDG1Vjtml9hpEhxRnDVKn1VTfGMkU7UH7GJiyg9K3dQ3dL8NcSavHrn4bHqRGMJa8kYkMoUDMe3i79Eh9Yif57KzkP2wTPR65W3NqXPMw9qmLCNlUcP5TBP4w5b6UfB7LC15CF_SzDdYhRiGkJN_ZtPSMm_k9KLjuqw Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame 52F8	35 KB 13 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame CE7B	0 23 B	48ms 47ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv4AzFpSHNX254aWNye0_U9b7w3HqHYBVykF8c9aIcoe3J1HZLaju-J-QeOW44sAfFYsO4IMG9hdXSy2KlJrmLrssaQMqWt-9SLerwEroi4szYlJDbWYDmHob0SLDs0Ag-C5-zwVJyTICo8XGqCaAkc&sig=Cg0ArKJSzEhFOOcZsfo2EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=129&vt=11&dtpt=129&dett=2&cstd=0&cisv=r20211111.85387&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N738225.3665442DV360/B26086838.311141236;dc_ver=81.235;sz=728x90;u_sd=1;dc_adk=3047537733;ord=1fuh74;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIvlJx6KbYYuFKumV7_UPtfyK8A7eq4ykZNGBvtmADsCNtwEQASD3u8eDAWCVgoCAuAegAfqa3tsByAEJqQIcIRu3xe6yPqgDAaoE4QFP0B8OFNH-QJRyzJset_i_iOmK0hO59YtbQm45WZ61euDSrcdau-GgpixJuM6vDjUNg1DRK2wJah9B5LMt8QWVA-15n4rbSNT4QLf51O2bYDMX74SMp2DNYy1LzBKcjZkx5LLWatW77YJF38KToYnm7zyRTvls_l8RNNc85olnZxJgnQjd0EMCnKKsj7oMNUMIOP-bHkQNFBMa1vTLiKUOPlPq8FLHhDulkcvrMIJJb5WAXu0f6bJo3uUgfXDrBOGT5a9SMGDArEdNpTpA2lg__bkbSjDSYW2g4zKVKGCmZhHABNaOo6zPA-AEA5AGAaAGTYAH7uShpAKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgOYCwHICwGADAGwE6CoqQ3YEwrYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo9iFoekptSkOwjKnn4HIQU2iAqQ%26sig%3DAOD64_2yBVCtHzB2y8sKTyu-Wt6Sb5tKAw%26client%3Dca-pub-8820362605711196%26dbm_c%3DAKAmf-AqpNSQ8VeWOeoS-0jBIaxr6WDQ8au6ogpJoPoir6OuZTlVag7qcMTqSuodMylBOHmF6RdXeVdmFC_gPnesh6U91eLWcZ-XPgUHqKSFiKJckRcTvgr6Da8agRwknPF1JoYYh33A_R11hDQwl81YHM_fOSeV3g%26cry%3D1%26dbm_d%3DAKAmf-Ds3UajM5vw882bRBUVXNk2Z9m2ZL98aljYui2hlDfdHDXT4GROmh4YCFK1nkmlMFfMLu-aT21wGwd3TOUfv-8l-yByIS1sYgDuKAIVYzofrKE9Pmzropc1gBsKy9s-ST0uncezI_UN-iCt_8UX4m3q9bgSOiAaiIfGqT5L9yyAe7SsLo-tcyhdI9Koik5nNwAu9dme8MJljkjzKVc-Kc0xhA-RxFe3yTXJVGfzBkhqf2Tr91Kje-sWOFWeTsfHAmhdRaHhBeFtZT27mL5TUPjWWcdGVQBEuYY-Y2RTgpTMThHn7D2o93A6Uq8cu5sqRskXzcg7Ad7sf3nUie3VkhFYL64qIdiinn-qW6mmdv6l3qhYz5UWQfwbL7VLwcQkocX2I_iwWNHVzpKf4kbYfM121Tzq9wIbLwCtQUfVtR9OsAJIzogJkBt_LKUEUdcRWdagQ3eGW9XdmqtXujQCv-mRWcw5NoHJSW4-WS-YgemC8N14fo2zb0iUcG9sVMIo9emQ1wml2IFuXL_OhZdA3H5QnGIJNA%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F$0;xdt=1;crlt=l7)K8ZFfJI;sttr=135;prcl=s Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	Graphik-Semibold.ttf s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	121 KB 46 KB	8ms 7ms	Font font/ttf	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/Graphik-Semibold.ttf Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d0546f328272fedc2222238e38b0a7033ba865dc158da9ec88a021f001d11e6d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Origin https://s0.2mdn.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:00:20 GMT content-encoding gzip x-content-type-options nosniff age 32485 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46842 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type font/ttf access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:00:20 GMT
GET H3	200	Graphik-Regular.ttf s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/ Frame 42E6	119 KB 44 KB	9ms 8ms	Font font/ttf	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/Graphik-Regular.ttf Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 64509beac62bcfa481a8daf34bc69ce7942e5a9807d81bc658589c0915f772fa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 Origin https://s0.2mdn.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:00:20 GMT content-encoding gzip x-content-type-options nosniff age 32485 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45148 x-xss-protection 0 last-modified Tue, 17 Aug 2021 15:22:54 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type font/ttf access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:00:20 GMT
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame E92E	22 KB 8 KB	6ms 6ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Fri, 19 Nov 2021 12:35:14 GMT expires Sat, 19 Nov 2022 12:35:14 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 264391 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	Graphik-Semibold.ttf s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	121 KB 46 KB	9ms 9ms	Font font/ttf	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/Graphik-Semibold.ttf Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d0546f328272fedc2222238e38b0a7033ba865dc158da9ec88a021f001d11e6d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Origin https://s0.2mdn.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:05:53 GMT content-encoding gzip x-content-type-options nosniff age 10552 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46842 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type font/ttf access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:05:53 GMT
GET H3	200	Graphik-Regular.ttf s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/ Frame A9C3	119 KB 44 KB	10ms 10ms	Font font/ttf	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/Graphik-Regular.ttf Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 64509beac62bcfa481a8daf34bc69ce7942e5a9807d81bc658589c0915f772fa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 Origin https://s0.2mdn.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 15:48:15 GMT content-encoding gzip x-content-type-options nosniff age 80010 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45148 x-xss-protection 0 last-modified Tue, 17 Aug 2021 16:47:46 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type font/ttf access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 15:48:15 GMT
GET H2	200	dpixel cms.quantserve.com/ Frame E3D4	35 B 463 B	43ms 11ms	Image image/gif	2620:116:800d:21:51e4:db4b:4436:b305 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHarnKuQIWBhOEROZvb5ics&google_cver=1&google_push=AYg5qPJQ-uAX9Y6gjuJP7pUu6XkqNEWuTRkrmm4cZ-xutCe0drVO0DjH3p1wyROHqMki15AS7ibFJY5kpSBWpLW8ygX8R4xyZfgC Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT strict-transport-security max-age=86400 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" cache-control private, no-cache, no-store, proxy-revalidate content-type image/gif content-length 35 expires Fri, 04 Aug 1978 12:00:00 GMT
GET H2	200	google match.adsrvr.org/track/cmf/ Frame E3D4	70 B 265 B	103ms 33ms	Image image/gif	35.71.131.137 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAZcalrVzDpx4-i1Jp_jW8Q&google_cver=1&google_push=AYg5qPKEJOp09rZXMVzw0Lp91UyFMrFtNrFSHAAU7cpzIH1LvmDBJCoeATAdZ4HZD8HcAgP-LGKTxtZV2Vi1tQfzxMke-Zxj5STB Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.71.131.137 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a6370ebea231e0c9a.awsglobalaccelerator.com Software / Resource Hash 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT cache-control private,no-cache, must-revalidate x-aspnet-version 4.0.30319 content-type image/gif content-length 70 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
GET H3	200	pixel cm.g.doubleclick.net/ Frame E3D4 Redirect Chain https://rtb.openx.net/sync/dds?google_gid=CAESEDRk3IWURAuHUE1p7VdPeOk&google_cver=1&google_push=AYg5qPKVgXQiRNrHrDLmDMh9iPprJAveGctF2BliIM_zN5HXp09t65o3Tsw7QeJVIPOpgEReYZX5H7kRuMg3T47WKZxq9L_3Za6D https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKVgXQiRNrHrDLmDMh9iPprJAveGctF2BliIM_zN5HXp09t65o3Tsw7QeJVIPOpgEReYZX5H7kRuMg3T47WKZxq9L_3Za6D&google_hm=Xn50hdmyxqgaUX4nX9IQ_w==	170 B 188 B	18ms 17ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKVgXQiRNrHrDLmDMh9iPprJAveGctF2BliIM_zN5HXp09t65o3Tsw7QeJVIPOpgEReYZX5H7kRuMg3T47WKZxq9L_3Za6D&google_hm=Xn50hdmyxqgaUX4nX9IQ_w== Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT via 1.1 google server Cowboy access-control-allow-origin null vary Origin p3p CP="CUR ADM OUR NOR STA NID" location https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKVgXQiRNrHrDLmDMh9iPprJAveGctF2BliIM_zN5HXp09t65o3Tsw7QeJVIPOpgEReYZX5H7kRuMg3T47WKZxq9L_3Za6D&google_hm=Xn50hdmyxqgaUX4nX9IQ_w== access-control-expose-headers cache-control private, max-age=0, no-cache, must-revalidate access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 x-request-id sjqj8itae88ur1olcbd35gdueauql6sb
GET H3	200	pixel cm.g.doubleclick.net/ Frame E3D4 Redirect Chain https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBx2uXzkv3aHWWXCyDQ99kg&google_cver=1&google_push=AYg5qPJ7ZdwTY_kPODvzRScWEnfzlM7acyBVhcIF55CLZVkqvrVdFrq2vlFwMiQXFmTY_diKktB... https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dBUU1OSjktMVItOTIxVg==&google_push=AYg5qPJ7ZdwTY_kPODvzRScWEnfzlM7acyBVhcIF55CLZVkqvrVdFrq2vlFwMiQXFmTY_diKktBhDHwU1ciL_evaeJd0byp_RRxE	170 B 188 B	18ms 18ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dBUU1OSjktMVItOTIxVg==&google_push=AYg5qPJ7ZdwTY_kPODvzRScWEnfzlM7acyBVhcIF55CLZVkqvrVdFrq2vlFwMiQXFmTY_diKktBhDHwU1ciL_evaeJd0byp_RRxE Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Location https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dBUU1OSjktMVItOTIxVg==&google_push=AYg5qPJ7ZdwTY_kPODvzRScWEnfzlM7acyBVhcIF55CLZVkqvrVdFrq2vlFwMiQXFmTY_diKktBhDHwU1ciL_evaeJd0byp_RRxE Cache-Control no-cache,no-store,must-revalidate Content-Type text/html content-length 0 X-RPHost 6f9fd0201ed801884e5299d5aabca094 Expires 0
GET H3	200	pixel cm.g.doubleclick.net/ Frame E3D4 Redirect Chain https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEGA9EyjXp-YiTDoEOemCjxc&google_cver=1&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ4XpFj4Nc3UwWAUHtLN790skimaWIRfgChWbPCof2 https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ4XpFj4Nc3UwWAUHtLN790skimaWIRfgChWbPCof2&goog... https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjM5MTQ4ODkxMDY0NzM3ODcyMg%3D%3D&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ...	170 B 188 B	17ms 16ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjM5MTQ4ODkxMDY0NzM3ODcyMg%3D%3D&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ4XpFj4Nc3UwWAUHtLN790skimaWIRfgChWbPCof2 Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers location https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjM5MTQ4ODkxMDY0NzM3ODcyMg%3D%3D&google_push=AYg5qPIvYbkT1ggHaqG5LG1_u56gExmKv7wI6zT8ZEJ9clh9s7_sTVxIjdjJ4XpFj4Nc3UwWAUHtLN790skimaWIRfgChWbPCof2 date Mon, 22 Nov 2021 14:01:45 GMT cache-control no-cache, no-store, must-revalidate content-length 0 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H3	200	pixel cm.g.doubleclick.net/ Frame E3D4 Redirect Chain https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENNfqmMTnrwZbXN_Vw4CU1o&google_cver=1&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9e... https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENNfqmMTnrwZbXN_Vw4CU1o&google_cver=1&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9e... https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENNfqmMTnrwZbXN_Vw4CU1o&google_cver=1&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV... https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBiYTQ2ZGMyZi00YjljLTExZWMtOWE2NC0wNmZmNDEwM2Q2Zjg%3D&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9edkz5ZDCBbm...	170 B 188 B	17ms 16ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBiYTQ2ZGMyZi00YjljLTExZWMtOWE2NC0wNmZmNDEwM2Q2Zjg%3D&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9edkz5ZDCBbmuFHXaM3bCeawtZIlT1x1EkJDV7c3f3cpVfKg Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers location https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBiYTQ2ZGMyZi00YjljLTExZWMtOWE2NC0wNmZmNDEwM2Q2Zjg%3D&google_push=AYg5qPJzjhMDI3X25RpAQbTIOJW4_umEU6aZt9H84yvSFlr24t1hBV9edkz5ZDCBbmuFHXaM3bCeawtZIlT1x1EkJDV7c3f3cpVfKg date Mon, 22 Nov 2021 14:01:45 GMT server ATS/9.1.0.33 age 0 content-length 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H3	200	pixel cm.g.doubleclick.net/ Frame E3D4 Redirect Chain https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEDqgzQKJcVpdQpPtsUAKqdo&google_cver=1&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwEq74l_PNjhQ4kQYdjJ... https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEDqgzQKJcVpdQpPtsUAKqdo&google_cver=1&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwEq74l_PNjhQ4kQYdjJ... https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1oN284U3VSRTJ1RTZoMmt6TDNfWmtCelpxVHA2Z2p2Vn5B&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwE...	170 B 188 B	18ms 18ms	Image image/png	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1oN284U3VSRTJ1RTZoMmt6TDNfWmtCelpxVHA2Z2p2Vn5B&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwEq74l_PNjhQ4kQYdjJg_ZZVta3sSCV7B-fQECaBPcD4tzA Protocol H3 Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers location https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1oN284U3VSRTJ1RTZoMmt6TDNfWmtCelpxVHA2Z2p2Vn5B&google_push=AYg5qPJENcZfGYUhCsMwSMk2T-E5NyGWquSrWpYEoAvETgudaRjOxElwEq74l_PNjhQ4kQYdjJg_ZZVta3sSCV7B-fQECaBPcD4tzA date Mon, 22 Nov 2021 14:01:45 GMT server ATS/9.1.0.33 age 0 content-length 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H3	204	attr cm.g.doubleclick.net/pixel/ Frame E3D4	0 12 B	18ms 14ms	Image text/html	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Id5MucNqfEugga2wMm_IQUbRSV2v9DW9Z33shebP6TYwNKkjsYwbSh4yR4T6auTeV5_5hc7K8 Requested by Host: e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com URL: https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 216.58.212.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:45 GMT server HTTP server (unknown) alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 content-type text/html
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame 5681	0 23 B	53ms 53ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstXtKYmcQ1DwJNJF9WF71mYPTMyG_wXyC2NGJiiwtCih3fV4Osa0V2icm1Kq0iKquorCqwaKRSVNtunFlXN0oFguwD9rdKOD9M0sQYTyOAXYG_haknd3eBlumbfmX93zHHY001bEShLVY37Y9Fj5bFSaxyKlCIXo5TpL4-TDc4OidoUu4ohLd_LzIx9Ykad74qqOGCUJGV4mReZvQ53b67gVrmZScDKBbAIbEgthDHllgb6VczWMyDxhqlZHW79FBKLBGdU8CGhT7-bs5CUw4-YjRKEwEABg5bss3x5PUjujB4mBLHyOPAGvxfMsYchqqmtaTY0rC0fcSShyf56De9zA_DdtXhIrOo3VyUHIh7ne0ygd4QnyI9xzFqQVbLMres7JYfoMLtbI5_INoedoodRCA1-beFYAzwH5Kirv74HTCifieDMpHeW3xRR6qrgz7kRRoy3kMCN6qYRF-3nM2YfDvOL6CQETjML2fVQpCrvKNTcyDOdWDd1wb23Z8YCwYOAdL2DzgZ9XI9zdOV2_7pSqGJIDVmAjtYMdNFm_LNuCJtkfVjGKIDwmOn-vRdUflyfhP-XNAAhU9HEmSlgrqcs0zzVxp_rnG_kPMrd1smbGIgcXH1IDCGAxxDjBwnLsDmFsnPGJBaSTmCYqz5IGD8SVL10RptO-lP-2kvrqVUTVX5r3-2hvUeuXDY2d5AiXyP-WC5mmiMobJb53J3lITwl57raBAsFM_lzkhTeqg5XipBRX2LvJ2hpyzjg78XvvZS93b_YBbMuOYReDPMV33nebo6NFt_UoqQNCqkz3ssZCSVw2FsnrhpUOhQPDRtKHcMemFCYIIl8Vn7cStlJlQRI7pzJzd4bzTkzMDN7z3ZwdJh_H1HiN7_UKG7lpv9Ub12eBmpwVHbNbToB2r9m_1yDlU9Ej3met2iicn7_29_hT0ccDc21KmJUIFODO69qm2AIw6sfy94lSNuEIchyfEZovK2Y0ZGEyoDUSP-W-lx6Foc94zbXmAyRNL3UgZhOlu1JpQ2SEhcWfkCaBfPs9ovUmUxT2WKj-LsYJY2lwmXDOW2nTD3G7lwhcBJbo6udNUjn5qLBgzquo5zKXaggPGkYMhboNYkB5MkeDlLJyLT8CvI9vbrnz-efO-picLBz_qYLwFzgDJL1Jkx_IsNP0C4IadXDbLpgR7RaHU1NW9lGwqVv1SJumFiIY7dkcsJoBdMo4U1qhglWlJiz5SlP0qWpJk1t7hCyH5Fph8NcAZURHG_m4e9yFXW-7RFkb7s7AeQxdz1BX3p0YkMHVdCKjCPwGmg&sai=AMfl-YTnb9rUJ3IssCvknZUqOFldsYX4kIyYjDpSDEVlvr99zgOHbP3YkqHONzbYWMGUuP3UixwegYvi4NFt9SQQXdoZ-PLREWmHMAuWlVkNOeB_XlEh5paZ6sNAqg0Rx0Ya79aoJWOOAynXwolCOjDWWJDXZ4vRtQ&sig=Cg0ArKJSzFDswJKI4ibdEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=587&vt=11&dtpt=424&dett=3&cstd=158&cisv=r20211111.97254&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame FB71	0 23 B	45ms 45ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwp0oM2bXzIjmy2UotbUaOQ7MFBdKBu7eBaMHvHN86CswTAS218o0kyVOf_n28t7rRBN89wE50IyvJXFBiQypnGgr7zMlUuQ5V9Bp5Bu52k2mHY3Ca073eygVsjV8HBHEoNKIXvsNAaEi8JIaaTRdmA3FaUStnmLN9YpFSHcz5WdrSF3hzY4Xnc7KFtnzTD8OpM0gDtIT-lGAS6i0E-j-ARkn1-qehzPgQmpvJ_rPtGaIgHP-9Ix6GdXh3SI_hCBnEnb8SBa9IWNyFD19XfoSn4BtkVk4-SmqNFjMdiIbk_aeHffmYd60PZ4qvEjjJRY217B3NAYYg3b-1bknNy74VscdWLLZiZTo6hUpdvenXLpuuFgu3BW8-oQkItc5qQbd10h2lyz8TGWUWBWZyJG9znmcMHBnJ5e0akareImYn1SJr1wotkMwoRXon458PPL7_tGznk0XD_jYZtf9TDbGNcIpIhfxBi7eEH4GD2zJKPReB1Kzheuce483tqDsd5I4G0rwnuFMqt_TRsONwsKGOjNk2Ul-oO-7Q3vJZ8k8Hj2EHigho60luMTUkqMRa5tPb87xu_R6LNF4_9Rk1688yohTtiVN83tSMZ99oBKkl5z6tyxC5g0ptP79vhkwGxF_dHFgArhrb9CcR6UHr-7BXhUd8ROLfezVkIA_m0OQs86vNzJ45OJJN9ADDQx7LTMv---OVLrwHbK5mYOpBbwEWCoJ-1_-2BP-2MKVGLIrS13iXxJI2VB5bBhMQRPkYh1Rg1P7RGOFUMAnZbNWk1Etc9Ae33pZWoU4hLtUWbAd1CwCgeLQkm7SlXaK-lNDKrMJAL_msxZ8cuEKQylBDGcMeI8r6rhOIY7CcZUPCAg6f8Sv12CrkhjNSUChntnH6zDDmYq6VzZvVIpTuF_9-VuJO-UvRvM_w-YRt1o_-WY3I8E1wCZfvT2s4UHL3fBq7noxsNBzTDcbLFSP1_vbKI3lMf4-1S7wWUDI6-Dek1u-Z_uGpGCmnW5K6wuw4ijIRxZceOGNA_seOiLhpmu53D4JCB6rVzJA1jeNX9NltMz7WQOIIjpYLS5vLG-qptXr6shGDmxxssCw17yhnqkLTyNJd73j0jEQzfY1qWgL5ywfEFswAvPY4IQUoaWlvbFAdIZyonpxONEXMTTg&sai=AMfl-YSW48I0o1Kh1e-Y4fPu9_SzusduMw2_88XXsRiIjgFivDqS8efWIyE5X8B1rJkOJXekR9_kUykkdMOEBGGi2bMop1Q_R9gD5mRhlLqP4pBP4M4gBKJJeS-jpqQ6r2aLXElqRdAj1ak102B_W7-5r3yP2X-8OtlGLl0WiOw&sig=Cg0ArKJSzMrpGt8gbOl9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=713&vt=11&dtpt=496&dett=3&cstd=211&cisv=r20211111.34507&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame 382A	0 23 B	50ms 50ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvkwZk77fI6bsGuRFXbXFO7_GuC2FsoVhC2KbkIj1qiHeAyrpSJHfF6bL-5WDzSc15_xV9b6F_ApYMeAEHuEOjdVMZv-Ou2k3zfSO91_dX91DsGIyy_FuNQTUXLP7ZCJcYr68E7wKclLXOtmUZeVb3FtU4TTdz_8XpN8Ys2sF9Yw0Hce7EgPwcjN_x3y86n2kh6PaqOUTJHTl3c2q99rFG8pu66F44Gh_P2TuJQZNjI0ohH-aoIDuqnEGupkZmboRaU9Dx5K0HM1PcVS6ScRg-ftnhqGEA5lUvasWYjYdfqOQ7Wbcg22AOZwlRkrZb_3LJyycU5xAj7WKQJfmDRTLMJM-NWOMgGhS204iw1iBExW-C3eQdzLw38FLxdW5PBkNb_OdHIPvEfVrEh5XYsgoUuIc0NDm-fK-CesyygWbDRrG7h53P20SdYv7q3-inSx0-0FMtUu7gemhnFcT8D9-tvLoHbM_o9jpVjkgMUADTKlZRFFA1zOAHhnJDwMyv1v_YOaBD49aT_uWe-uCklUTw89K_hJ6dLxf9JV-lloXZyQY0K8nqZL3aQ8oZgGvJwR_E89btxd2qES4TGibjhshlVIOHmZ4JsecaiI7ZnwXgeZA73JKGmVlWZEEU8R-0LjDDredl7P6kiXOhzcf3bKy-8fExcfCHNGs_h9lfJj_2h_pJoswolApRTMfRNw6s75UeAQ7oCZfY7UgXRZPT0ryJxB41wxF1VFjBXTZtqA-wpmZyJem2yzjjtiXjitHFWXyOZUHQ3YQJqU4Hik6capQ8QCebjCK5RCqJPVQ-q6UgCdJ07JGAPu5dV4sXswNWtcu2gXIOv8rX-ARIJ5nG983XUg-JS2rvCjlAhm_4Vwy5-cIb1jVj32ya898UISwusk1mNe1h6iIONaDymW6sxAF4bC23MHy00U6JenW2QgQfnraqoCC__xhqs87fV1ZdYP5XzG_sUDh_uE4BTt8IqYfeISF9tUjErwDtVb6zR7KV9Tc34jsF9DwZkWwZOdeeD_zAqzMHe5enRLUzi2fjguoYAgueqEes1GSLo5ZK9QpEToAEkt0XLFoWD-KGItfyzwRlFt7MHpDARfYbDwfRiFK-ItwPGkDH-rXHLfKTVWNhaHsYcXWy3HOHU1DzzO1vd-RRiTPnXOg&sai=AMfl-YSxRLaovEvHzlks_MNtblK-huc5_SEsJzvuv9FueQykRPfZ0xUnBOP2s8cevwSofJ3jpcMGg2HcaC7B9N-wcFsM6Poz-Um_NLBo80ltKGFXdKqVIYtNfuQ8DZ6i4zCj5Kq8pqk38tUub_ZvDUyJ7Mk7tPJFf29KYwkDLyE&sig=Cg0ArKJSzC_NECqC9lw6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=683&vt=11&dtpt=487&dett=3&cstd=192&cisv=r20211111.09142&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame 8A70	35 KB 13 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame 5681	7 KB 5 KB	36ms 19ms	XHR application/json	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=latest&st=int Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/html_obb_rendering_lib_200_275.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 83b35c890fdd8132772e3d0b8b37c962f5ac396790137a93a0f3b42d3cb72025 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5239 x-xss-protection 0
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame 2D80	35 KB 13 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET H2	200	pixel.gif px.moatads.com/ Frame 2C26	43 B 260 B	9ms 9ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-NiIrBeoFGpG4fz6GF1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-EcfEEAlWe0wLgg%3D%3D&sc=1&os=1-gw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=123&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=78&w=150&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=3&f=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1637589704174&de=963698074774&cu=1637589704174&m=1282&ar=b4494b788bb-clean&iw=5b2ce75&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=123&le=1&lf=249&lg=1&lh=116&gm=1&io=1&fa=1&ch=0&vv=3&vw=0%3A3%3A0&vp=0&vx=-%3A0%3A-&pe=0%3A127%3A239%3A783%3A362&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1271&cd=68&ah=1271&am=68&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5823350303%3A138371350639&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=0&zMoatH=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatDev=Desktop&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=2&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=195602&na=1022870&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:45 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/ Frame 2C26	43 B 260 B	16ms 15ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=1271&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5823350303&L4id=138371350639&S1id=22308610192&S2id=22364980590&ord=1637589704174&r=963698074774&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame 42E6	7 KB 5 KB	18ms 17ms	XHR application/json	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_246.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ca689c23a05d1834cae804d34ab8ccf192a52175bdfd8d075e0a13833670bc9d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5117 x-xss-protection 0
GET H3	200	60019689_20210701071753329_Button1_300x250.svg s0.2mdn.net/ads/richmedia/studio/60019689/ Frame 42E6	320 B 246 B	8ms 7ms	Image image/svg+xml	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210701071753329_Button1_300x250.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3fafcfea8f029a207adbff8ebb12bd62f6b129656fe72da89f09a46c0e585c83 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 17:37:58 GMT content-encoding gzip x-content-type-options nosniff age 73427 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 210 x-xss-protection 0 last-modified Thu, 01 Jul 2021 14:21:18 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 17:37:58 GMT
GET H3	200	60019689_20210630083650481_300x250_ASG_ACNLogo.svg s0.2mdn.net/ads/richmedia/studio/60019689/ Frame 42E6	3 KB 1 KB	8ms 8ms	Image image/svg+xml	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210630083650481_300x250_ASG_ACNLogo.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a8355d33f3dd35891b695850ed2c172b5ee8487fba03fdca3dca6449667897a4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:48:12 GMT content-encoding gzip x-content-type-options nosniff age 26013 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1139 x-xss-protection 0 last-modified Wed, 30 Jun 2021 16:10:02 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:48:12 GMT
GET H3	200	60019689_20210630074045676_300x250_ASG_Strategy_IMG1_Background.png s0.2mdn.net/ads/richmedia/studio/60019689/ Frame 42E6	111 KB 111 KB	9ms 8ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210630074045676_300x250_ASG_Strategy_IMG1_Background.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0a1df1382682af3fcc84f3db7fa36d63e126aea7b576859194ea011c7bf30923 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61844684/20210817082254514/index.html?e=69&leftOffset=0&topOffset=0&c=DYUL57i245&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:58:21 GMT x-content-type-options nosniff age 29004 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 113968 x-xss-protection 0 last-modified Wed, 30 Jun 2021 14:40:45 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:58:21 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame A9C3	7 KB 5 KB	27ms 26ms	XHR application/json	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_246.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 4ef69bd042a3caee5f9992b54996e9f772f450e54dba11f0308ad2de333351e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5228 x-xss-protection 0
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame CE72	35 KB 13 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET H3	200	logo.svg Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	1 KB 609 B	7ms 7ms	XHR image/svg+xml	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/logo.svg Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ba4b99098a12e6fcbabaca68424d9841e51649b8f072d05817fbf52823a7c8fc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:31:04 GMT content-encoding gzip x-content-type-options nosniff age 9041 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 572 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:31:04 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame 5EA1	7 KB 5 KB	24ms 23ms	XHR application/json	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_247.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 25708c32f7cd398c08fee8d210cec9fca07d8e838a2144165b4b2816a106c3f1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers timing-allow-origin * date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5157 x-xss-protection 0
GET H3	200	60019689_20210701071756058_Button1_300x600.svg s0.2mdn.net/ads/richmedia/studio/60019689/ Frame A9C3	324 B 249 B	8ms 7ms	Image image/svg+xml	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210701071756058_Button1_300x600.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1b8589fe68394ab9634c459045577dc4a65869259329416c304b61a64c381be4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 17:38:27 GMT content-encoding gzip x-content-type-options nosniff age 73398 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 213 x-xss-protection 0 last-modified Thu, 01 Jul 2021 14:21:20 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 17:38:27 GMT
GET H3	200	60019689_20210630083653456_300x600_ASG_ACNLogo.svg s0.2mdn.net/ads/richmedia/studio/60019689/ Frame A9C3	3 KB 1 KB	8ms 8ms	Image image/svg+xml	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210630083653456_300x600_ASG_ACNLogo.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a8355d33f3dd35891b695850ed2c172b5ee8487fba03fdca3dca6449667897a4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 05:02:26 GMT content-encoding gzip x-content-type-options nosniff age 32359 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1139 x-xss-protection 0 last-modified Wed, 30 Jun 2021 16:10:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 05:02:26 GMT
GET H3	200	60019689_20210630073954402_300x600_ASG_Security_IMG3_Background.png s0.2mdn.net/ads/richmedia/studio/60019689/ Frame A9C3	299 KB 299 KB	9ms 9ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210630073954402_300x600_ASG_Security_IMG3_Background.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash dc486d18fe4a46bb03b0133f60cc9986f14cd998294c15033d3c01e88dbcac89 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61838341/20210817094745818/index.html?e=69&leftOffset=0&topOffset=0&c=GkfKRjJJb4&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:25:17 GMT x-content-type-options nosniff age 9388 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 305960 x-xss-protection 0 last-modified Wed, 30 Jun 2021 14:39:54 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:25:17 GMT
GET H3	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame 5681	17 KB 6 KB	32ms 32ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame 42E6	17 KB 6 KB	36ms 36ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_246.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	img1.jpg Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	22 KB 22 KB	8ms 8ms	XHR image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img1.jpg Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 72aa7635341b25a097f299e5d74b0df5b8249aace15daa54b311183cbe432d29 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:01 GMT x-content-type-options nosniff age 10064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22677 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:01 GMT
GET H3	200	IDpL2rJiZrNY3rYqo4eIGDY6phXtx-GzYRENHMIWWlE.js Show response pagead2.googlesyndication.com/bg/ Frame E92E	35 KB 13 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/IDpL2rJiZrNY3rYqo4eIGDY6phXtx-GzYRENHMIWWlE.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 203a4bdab26266b358deb62aa3878818363aa615edc7e1b361110d1cc2165a51 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:48:44 GMT content-encoding br x-content-type-options nosniff age 7981 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13371 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 11:48:44 GMT
GET H3	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame A9C3	17 KB 6 KB	47ms 47ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_246.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame 5EA1	17 KB 6 KB	45ms 45ms	Script text/javascript	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_247.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 14:01:45 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Mon, 22 Nov 2021 14:01:45 GMT
GET BLOB	200 OK	89e3a92f-b2f6-44d2-9786-7afa8fb0e8a3 https://s0.2mdn.net/ Frame 5EA1	22 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/89e3a92f-b2f6-44d2-9786-7afa8fb0e8a3 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 72aa7635341b25a097f299e5d74b0df5b8249aace15daa54b311183cbe432d29 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 22677 Content-Type image/jpeg
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame 5FB4	35 KB 13 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame 2D07	35 KB 13 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET H3	200	img2.jpg Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	21 KB 21 KB	8ms 7ms	XHR image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img2.jpg Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a3872b77bbaea007012fe7e59bc7d7da8e9ffcacd5c5aba87a88c3467e957ac9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:02 GMT x-content-type-options nosniff age 10063 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21802 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:02 GMT
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame FD5B	35 KB 13 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET H3	200	W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response pagead2.googlesyndication.com/bg/ Frame 518E	35 KB 13 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 13:45:25 GMT content-encoding br x-content-type-options nosniff age 980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13296 x-xss-protection 0 last-modified Mon, 08 Nov 2021 11:58:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 22 Nov 2022 13:45:25 GMT
GET BLOB	200 OK	846a6f68-092a-4405-bd32-f764b9dc4872 https://s0.2mdn.net/ Frame 5EA1	21 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/846a6f68-092a-4405-bd32-f764b9dc4872 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash a3872b77bbaea007012fe7e59bc7d7da8e9ffcacd5c5aba87a88c3467e957ac9 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 21802 Content-Type image/jpeg
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=nav&zMoatvguid=-&zMoatptype=-&zMoatsl=nav-ad-plus-leader%3FT-1000&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=436&gp=5&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=371634088549&cu=1637589703774&m=2042&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=5&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=1196&an=14&gi=1&gf=1196&gg=14&ix=1196&ic=1196&ez=1&ck=1196&kw=962&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1196&bx=14&ci=1196&jz=962&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=962&cd=27&ah=962&am=27&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=4&jm=-1&tc=0&fs=195794&na=1145705709&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:45 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	15ms 15ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=962&tet=1196&fi=1&apd=1209&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=371634088549&t=iv&os=1&fi2=0&div1=1&ait=0&gpt_target_pos=nav&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=nav-ad-plus-leader%3FT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=5&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	200	img3.jpg Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	22 KB 22 KB	8ms 8ms	XHR image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img3.jpg Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bd09a5445ab1d930c5b98c384ea8d591f580afd7a650c2c1763da51cf533f6f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:04:20 GMT x-content-type-options nosniff age 10645 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22925 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:04:20 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=nav&zMoatvguid=-&zMoatptype=-&zMoatsl=nav-ad-plus-leader%3FT-1000&g=2&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=436&gp=5&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=371634088549&cu=1637589703774&m=2043&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=5&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=1196&an=1196&gi=1&gf=1196&gg=1196&ix=1196&ic=1196&ez=1&ck=1196&kw=962&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1196&bx=1196&ci=1196&jz=962&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=962&cd=962&ah=962&am=962&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=4&jm=-1&tc=0&fs=195794&na=1375723812&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:45 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 52F8	0 20 B	46ms 45ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3RhNyKKbYZSVHOLg7_UP4OWB2A0AAAAAOAHgBAI&bg=!mpmlmd3NAAZQLpa_UC47ACkAdvg8WkzeZmyEzel5SNtN_3A8dSxOgUHhpg8hdF8we3NxNqW9yZK3rAIAAAF7UgAAAH5oAQcKAMCn5Yamec1gOk5O1HW77pMeKal_o-FntZDmaNGphmgYQOYdZhqJrqPj-RwET_q7x6EPMAYSBCfGxrZT9R6Sr4RYgI0o8o4FHZ4ZLZ9oNvLwpBz6ZRd3nxBrRDv3tIkwEgekSTcYIzn-TmOrfoXyK8MrW-_6LR6y01mDjSNn-FTugO9npdbHj4Aw8DWQiS2zQ6Y6Q7HiwgdEBbPWHHIp6w_ewJ73N_h1s94pJ0KvuT5Abm6Zux5YIcwhMnAtuk3yNFOZAsDFH4SQQjuNXkIO19F-Xq97OtmlDkoCDwZGYG1DnPR4l94L5ZWHYD3Jl3y7OqE-6CHj2ncFTOip_simCScfSrFnBwILMTRFMShzz2Zu2bSDJXj7gINzIITVeyo2rOUAFz_SoyA691rA56fGf-WpIn1n9ENdkDGJKHTWYzWP9JF-nnPKMor2rh2mqMVhwJiOeje2zPRZVUJEQbi2CriOURTwOP5xMBcBm0hDNU1Lv11hlOu40xBbPLMbWsoji9RyZDLAFPDKecB1wijzuaiyrxchwLJgcd6qunnV87UzYrbtDPlHrMBsrtlC2bMcVtVaSnbslC1XAb9otriY6MH0BkHiXpEFg1Kmp2PsYH1UE2iqi8YtGbF4m_fvZPu8bIBO7LPZZl5YlFkH7IZ-w9DcfnyhFzs0pQunR_-Bzr6aE0xnx29_bAHZlYGynxgE8cnLVB3b6JuQogZ8TKQbiwTEw6QcZlsIWEE7FBMqbcQPrKYzdJrolno5yG92NLdbqSr9K6_VC6-k6k1XLZtxqmCS4aWS17THnjUBYq3mdz16T5Ga8tZugeCmq19XFV9Ut7Mt_xN_2iqbc-ojMjdjtiJOxrZ5bee8pQDVO5jJXybTzVlJoh0vA0LlPfqI11Yo1H9kSaxfFojvrCB3g8bXlwGi9KoX209t3p4608INjz7sVFiWSiKYz6MDwJqmJ3BTh3D6sHzsX4mEfLpqzcT8EN1tGUWc0CXxLf_48YWd6jvV4uEQcmWv-l6DO2PgCR7mfebZeImm2tJVXzVKi2n_aC6jF79BJRghvntNKN87MuM7X_IIcv5cRWmsBG4jcUU-yeU85OxspTxmwkNpggTFfXafR1IzzeeQFdOKpq7FVcBLW0dAob00EoFsB2aevIh_pUdAR4gOnvzeUFWFnIRli3iuSg-ooOrHNhUZf-4TRNVqSd4dJw Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:45 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET BLOB	200 OK	c08f1d98-962c-400a-9755-fca60e4d37e3 https://s0.2mdn.net/ Frame 5EA1	22 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/c08f1d98-962c-400a-9755-fca60e4d37e3 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash bd09a5445ab1d930c5b98c384ea8d591f580afd7a650c2c1763da51cf533f6f5 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 22925 Content-Type image/jpeg
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=nav&zMoatvguid=-&zMoatptype=-&zMoatsl=nav-ad-plus-leader%3FT-1000&g=3&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=436&gp=5&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=371634088549&cu=1637589703774&m=2043&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=5&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=1196&an=1196&gi=1&gf=1196&gg=1196&ix=1196&ic=1196&ez=1&ck=1196&kw=962&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1196&bx=1196&ci=1196&jz=962&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=962&cd=962&ah=962&am=962&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=4&jm=-1&tc=0&fs=195794&na=1576263845&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:46 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	14ms 14ms	Image image/gif	104.108.145.172 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=950&tet=1153&fi=1&apd=1170&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1637589703774&r=974567281937&t=iv&os=1&fi2=0&div1=1&ait=0&gpt_target_pos=top&gpt_target_vguid=-&gpt_target_ptype=-&gpt_target_sl=mpu-plus-top%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Fsecurity&bedc=1&q=5&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-145-172.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:46 GMT
GET H3	200	img4.jpg Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	183 KB 184 KB	9ms 8ms	XHR image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img4.jpg Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 98896d690f7722ffa558a934326bd000bdd2e3606670b3a355973413fd885ebd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:28:07 GMT x-content-type-options nosniff age 27219 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 187851 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:28:07 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=top&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-plus-top%3FLL%7CT-1000&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=600&w=300&rm=1&fy=1050&gp=421.796875&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=974567281937&cu=1637589703774&m=2262&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=421.796875&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=1153&an=17&gi=1&gf=1153&gg=17&ix=1153&ic=1153&ez=1&ck=1153&kw=950&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1153&bx=17&ci=1153&jz=950&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=950&cd=34&ah=950&am=34&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=4&jm=-1&tc=0&fs=195794&na=593300479&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:46 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 8A70	0 20 B	47ms 47ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BeKUhyKKbYe7IH4KE3wOyqragCAAAAAA4AeAEAg&bg=!FRalFlLNAAZQLpa_UC47ACkAdvg8WqqLBUOqReF1Q2bd9B7Ku_7M-fIXHbd6ySSO9KKQCae8s24nZwIAAAGeUgAAAE9oAQcKAFdGh9HDPffWfpZJ9SCSxYGWaKjpad2oVr9KJmV3iRvJ869VkHfzPo4G65Yxgwb3kpKUJpCj7XdxGGeWrz1Fx2DMRhtQRpwbakI41Tusocp9PUU51ekTJN6ZAsZLINsN8OWYoTVysYSG6J1eLWfLZeGqYl0GuXL1-G4h4vPiTyS5RgSyFAHlJUXekCMY-h8IHfvpYfbV134oDdOUMiNrZoc67hX6r63SLkwWpfZT27ep6QvLwuxtbg5XWkpqBdcGSblcpxmy-1pRATyUcUyH5XGu1KThwezDXNpljlCl94rXa62KOBF4Fg-9mj0kQZDc8ZNRP1Q6kZBt4a8V71eeXaUYViOle8uD1SJSIPdfFeL2dIEKm0WQZovDvJEhc9hL29RJPKoVFT-0j19ebJQhWV4GrcLTD-u91VEviaCvxdxIGOka_2t_mrDynD9iH1hBpHOXqEKgbPYe3IO_eZruvv6ltggrRdB-OUIAa0W1RvmApKUrnA9t8yCIiDZvHBxgM160hmpKdPWMqNnPbD1oyMwsG2mnu5f3DRstpaeTqj4j8cbocWHSnp4KcPo3lFbGE0VTVgYie7M4Ws2Z22eSK7FhBnh58ZpM3-Dp74O7VL2-WyEs9-9_GenPPUCvOkcONYsWrY0rCXSqVmVkWRLyYDeOIcqZeOGTHwUD42FbjnREU0A0fVSN_-mN7dnmqyU3JmqG_InWJRnvT_7PNMZthmLDnc_YbluzasWz9rJzlvkqEag3UahycOHQZwowzdyiQH0wS5Cwe_u1OnTnkOKUnrDVlk0vx0meJWmBcrbXN7fDLIC57avueVBaGaBgwKXsm0XwDweVUC1ddT3e6wVmX0Ny4hRTT7LdulwixkG36t4BOTRfCRh1NMUvYoEbiEVhZdGKP_ROZO-pnV50lmufiqo9dzaYR0dvGlPlUDwxryaagaXAnOQ3A6xVM-ndbxotrg7tH1oxES2i3BhULlWiSDVrKEjtG1FofkgVW4-DvX504Fa2ZsNW_Aw8hJx46T5RIoAfgclRt4HHdsVOe96F0HoG7-PM5HKFpfhe-Z_AyS4nWQ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame 382A	42 B 64 B	41ms 41ms	Fetch image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvTFueP4JWzJTkghk9qK-bkmd_E3nnz4hHj7_I1iqxN9S0AoARoR3oPRwz4-rK9gAoI_AH2imZO-20FeIGCmE-ErFjIt8BiGwpw8eSDDAWTfSAzsyFpVA&sai=AMfl-YS9EJj2z-ChXsBcgGEa-JmZ1qVzj5ACQVfoemkR1LGGHJZ0wK7WpaeLoyijV9cqNxcatM81ytvJriB6TnID8b8ZsUUFZZlowPSDm9yqLFfCbZU59d2EhJhkoc_dEmww&sig=Cg0ArKJSzDV-rvM3Bp9tEAE&cid=CAASFeRo4-edcUeFBDDg4TktqwO1uwNJYg&id=lidar2&mcvt=1025&p=422,1050,1022,1350&mtos=1025,1025,1025,1025,1025&tos=1025,0,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=36326968&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1637589704317&rpt=740&isd=0&lsd=0&met=mue&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET BLOB	200 OK	88646819-6257-4af7-b675-7475917b3008 https://s0.2mdn.net/ Frame 5EA1	183 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/88646819-6257-4af7-b675-7475917b3008 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 98896d690f7722ffa558a934326bd000bdd2e3606670b3a355973413fd885ebd Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 187851 Content-Type image/jpeg
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 2D80	0 20 B	47ms 47ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B5ne2yKKbYerEIcjKgAeTi424DgAAAAA4AeAEAg&bg=!FhWlFVHNAAZQLpa_UC47ACkAdvg8WukBkd5Dp9nO0zFx4jY36tCDyvLNMa2gaT7VVRJ-ZTlPw6wktQIAAAGuUgAAAEdoAQcKAA7ZacI4eRyc9ArELNLPMZkCzsZNYjosHKr5YVzYkU4FXp7ncGS6pg6tTx5GWvdJ-zp0whyb0zo5OfPAvuk3VMo8rhnXIOhjmmxC7Qalkg6Ru7rpg2yfR_5z32hBZeetECevVSqw6lYYWwRhXqx7y9XILetuKMeU6EOzdpmc-GxncFb_z36eUy29sH_4zDo8aeGwETIj5C8EWUF23eWYgLP5T-NmEcXFiCZ9XzbFa6Zq9Q9XjihqYnx-78Rs3Cf8CDp9Io6JrVoQwkWH2GJuQJrIX_1wjWFxOzJGTykmuEimBv_m6p2fIe-xSouf49ADXAopXoG_VNSRbwROpCMpLW7r0k7eeUrDy8wWt4SyPtQf0FOIqXF-z75rBorodyj6SUkRNMtIZ0Ln1D360zb93VFoSHM6Z-QtS8ptMl7VEIUDcZM5TDbQtc_L1EdnOHxgM8LtfdDVjDeTI6Va8D-h9UJ13WPP49PM7MMCrbuVm_xzMXwP5j7MryRFbbjcsvsmH_cYaNDiCosRhuw229Az62b4ZSMWLG_qWCow1eeIHIeBjVAF-jP07MwoXVjnQ_nHHyoSvVEuUgW2nLBQROa7MaqThDFkrb3a1gG0F-ALCf7h9DFEfB75wCwYE3XFSzvH66G_z7ML8crd-VV6v73501Uyk1tkDSUiXXd0Kdav2kTFljoyaxU685jGbNW-H8I7LOSARZm6u2RfRGZlqVGYY3NSk6r-0uQrHTWzAgtvgC9TEYIYZUAhi-zYj7fLZotHnsufpQjFTPXKM2V63c7GV7_Aif7y-cBlhp969zwWnCKPB8oqUtOXf2gnx3grrl4dFFGAtx7kVKyfpIWqwHXI0lZISMl7MxogPPuqvkpwR1Q1uHS1NGTOGyQnINP6IrHoWMcHq-lT4-4nQG2ouzHoR07HN4ZjUpd-kLnxNlA0H68z4IgghWTLOwEm_MuHhTUVU61ZDQuiWpdWtbKT2o158w8 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame CE72	0 20 B	45ms 45ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9CjLyKKbYZfBI9CN7gPgp6NwAAAAADgB4AQC&bg=!VValVhLNAAZQLpa_UC47ACkAdvg8Wpyd9CnkMQAVddo_-ehVYp9Ax4tlARqJPiJ0gyOnRNugLJdCXwIAAAGSUgAAAEhoAQcKADeU48_HirntSLb94f2oMHDjozh0PoYhvy7JEDquF8qCPlJueDypmMQnWw6q-TLSaGIMsggNFNO-mQLZcs0ZzZDIiCf5-1lLdMhFKxwXdTOEMMpO0ZZib2iyK1dJ_9ocNmjc2kXPg4ZaKpjoZW-qBbOOBt_ZfHtas3OHrxFuR_3-1OD0e6oQrhFre1MLifYHwf6g4wrJIlZOcUN_9hGpcvkKufc1ttbrneiRxRejXb_Tc148KdKdMBlkpVtIcYnIBh0ToF24LiztzF745q-XlbN36LHFFNhS_USJr1UjLIKe5gvdg8miLtKKoNwOI1x6QF19XIyZmucACre9LzMhbXKNCCn2HckVEJGAsNCdg5kh9f73EHVS1401Z6x_zKAuRa_R3PT1JTZZkkzuOR2Qfj-pfNHxIzXGUguyobmG6ZfEo7Ndwq9lEFUB1IoWukaVeGmNvRKSNtBu-I0TOMCrxhR6CVSSay8jLf5KpqxYi7nNRU0P1Q-fTup3wDvFpg45UpQFHdAtTCd9Rhgz6t27fNpkZp3CZwC6sdau8zaMlKKiQpvXpFv3qh5cgIUGm7WpBBX2if_-KeY7oPuvA9JlDvzvzhCTviji4k6zBJ5NF3fIJnQtHfOZTESCsCM-ZCXsDrdsrchI__C8Mrsct0Myo0rMpmRjy11Y1WAlbGXnLwT48_uMA0Wwwhklr06TH27dOciR7hxioR3BLIJ_cJyVh9etTUMeWJVIeAHfIXKwmnc7TKPnylm8RrDzELSqDCyQbHKVpO2L4TEMTgkGiWeVmhnNrkLNhn7mpfdsA6m5QXZZyZVMmag1VzgYDeDtIayQJdODO6AxWOY1XKuHvizMxbgu-Ry0sfxz_i2Lom_AUCSriAzmTuyCR7LkzlVXqYLPj3hlGDmJliXtXVzzplNbWTM-P_AwYJXKeixtxTRoui3jx2EGSr7hkYgzs0qj8sf_Lizplk5h3j0nH5x95Hlz_Hpk-3YrE2U9djAR2w2dSfRTs9wXcPXzJT6IE-aEZJ__ISrtY44BsZlTNHZJaiMNR1VihNLA Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=top&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-plus-top%3FLL%7CT-1000&g=2&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=600&w=300&rm=1&fy=1050&gp=421.796875&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=974567281937&cu=1637589703774&m=2263&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=421.796875&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=1153&an=1153&gi=1&gf=1153&gg=1153&ix=1153&ic=1153&ez=1&ck=1153&kw=950&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1153&bx=1153&ci=1153&jz=950&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=950&cd=950&ah=950&am=950&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=4&jm=-1&tc=0&fs=195794&na=174603438&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:46 GMT
GET H3	200	img5.jpg Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	34 KB 34 KB	7ms 7ms	XHR image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img5.jpg Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5aaccdf3ef85292e38d514ea328cac34f57844b6d0401ae848bc82193fe08f17 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:02 GMT x-content-type-options nosniff age 27104 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35076 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:02 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame E92E	0 20 B	45ms 44ms	Image image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BVFoMyKKbYb7xO4ik3gP1-ZOgBgAAAAA4AeAEAg&bg=!bW6lbirNAAZQLpa_UC47ACkAdvg8Wg2v0uxF1ZRIl-TxKBpj2bA4iBGQ0Ap7yIJXhd_vG0lU7kZoAwIAAAGqUgAAACVoAQcKAD3i0wYV8NamyUdJQEBHykM_8dghicgrqT6FdBoC1AI6myUqUX_vszryqWYUf41cF1kcCr6z9cZ2jBI29D3jmQLCVOkWlx2ot0wBgps25Si06Nu_VI_AACQJMCMvBD2cDzRc13HyGy0LNao_tvrWUyrkRPHoMkFMrboGuRsjuvkMh7j9onWkpWMfcEjvikjzltqU1ZQ85HdDaYY7ChJr_VzLtiOSO7h-BrYqM7YeSOmMME_fkkjmQ70CSZXVY06C4xKv6v22AtmN2Bp6-644xmQH9bWOawYYRDk1qG_5JpkWsZBEavt_poF6RwCgaUGks_1Fw7YsXI2WQCKL4n1oH-DR4DwFRMW2nHtp-W33fOkNHStVIdEOX4qI7qInM_zdpgBUN6RkdhxztKbCpYkIL7uG_7efaRwtgMDdmYvKuudk6nIHSI60Vo-OuYLvbt58W6hvB7TUjHliMN-ubM3LLFguiAkikYPmwNII2FLVbOFmARhvrBdmf33prBpY5m5EFxmDyzxdjotqsN5IwoDpxoJRC9X0CYQ5-0o7GWuKFveZnWhrZl2Urluo8JXP2hbyuAsfGpyQPM_oYaE4_AQBqkPc5hHpmgFbVWYtD-4_bKuX-tJUp96XV5O_nfoiq4roSPjWNhPFq0Q6qd6783disqoHu1uYZNEQZzAiSbKy445_O1xOV98137QIaRgBRyjxNA2piYliJicgZItXW2op0KC4ccJYGvbmTPaDi_vZGEYJcu74ELXDl-BZ9jh-DBbCfdi9ka3uAekwMu16dciErUJgmVU9rtyTEJsFNpBPf3OhOPloZ0SFegeBIKaLSTGuncv_ouGvVSAs_MGHx5Ax7utxgTVktGL9Po2ptjgryIZnq5nVG6hzRfhDk-4dGLvUGELUT9xvYFnWjjAUO3QkFYnEsrF84zoqW4a0Q1t3YGDKVSYkcsb_eaptul2-wfVd7UzMnCVCkvuugM4_hGuSOL6sng6AkNfinv8lRo6a6vtv1-dkHr6KIbreYB-INjGH-s3GNw Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=top&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-plus-top%3FLL%7CT-1000&g=3&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=600&w=300&rm=1&fy=1050&gp=421.796875&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=974567281937&cu=1637589703774&m=2263&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=421.796875&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=1153&an=1153&gi=1&gf=1153&gg=1153&ix=1153&ic=1153&ez=1&ck=1153&kw=950&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1153&bx=1153&ci=1153&jz=950&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=950&cd=950&ah=950&am=950&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=4&jm=-1&tc=0&fs=195794&na=1407755537&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:46 GMT
GET BLOB	200 OK	803ad20b-002b-4f91-96d4-a5efb592e939 https://s0.2mdn.net/ Frame 5EA1	34 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/803ad20b-002b-4f91-96d4-a5efb592e939 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 5aaccdf3ef85292e38d514ea328cac34f57844b6d0401ae848bc82193fe08f17 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 35076 Content-Type image/jpeg
GET H3	200	copy1.png Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	28 KB 28 KB	7ms 7ms	XHR image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy1.png Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 14d80967b29e841707f5d56183dc7b25b9ff8e5aca13cada1ab2e9d0e984a8bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:18:31 GMT x-content-type-options nosniff age 9795 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28795 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:18:31 GMT
GET BLOB	200 OK	eee291fb-6209-4cfd-8411-de9f05d38b94 https://s0.2mdn.net/ Frame 5EA1	28 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/eee291fb-6209-4cfd-8411-de9f05d38b94 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 14d80967b29e841707f5d56183dc7b25b9ff8e5aca13cada1ab2e9d0e984a8bc Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 28795 Content-Type image/png
GET H3	200	copy2.png Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	28 KB 28 KB	7ms 7ms	XHR image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy2.png Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fe949119743aba166776208bdaddee454df1c30a47439c3c4f00240b9c5ea13d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:02 GMT x-content-type-options nosniff age 27104 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29134 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:02 GMT
GET BLOB	200 OK	93339aca-0963-4f3a-9598-718237fadefe https://s0.2mdn.net/ Frame 5EA1	28 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/93339aca-0963-4f3a-9598-718237fadefe Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash fe949119743aba166776208bdaddee454df1c30a47439c3c4f00240b9c5ea13d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 29134 Content-Type image/png
GET H3	200	copy3.png Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	44 KB 44 KB	9ms 9ms	XHR image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy3.png Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 42e655c6970596e9792f613ae0b00742222221a4739498093d506faf9cf1768a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:02 GMT x-content-type-options nosniff age 27104 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44675 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:02 GMT
GET BLOB	200 OK	dd10b812-a1f0-48a2-b7c6-9b4856958eb5 https://s0.2mdn.net/ Frame 5EA1	44 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/dd10b812-a1f0-48a2-b7c6-9b4856958eb5 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 42e655c6970596e9792f613ae0b00742222221a4739498093d506faf9cf1768a Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 44675 Content-Type image/png
GET H3	200	copy4.png Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	41 KB 41 KB	7ms 7ms	XHR image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy4.png Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d49b412dd0e70c99220ceea9efc30666ee85533b47fadd2cb0bb7a20c863f065 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 23:49:24 GMT x-content-type-options nosniff age 51142 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 41472 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 23:49:24 GMT
GET BLOB	200 OK	c0c7f8e6-44aa-4c75-aad9-e958e0bdb20e https://s0.2mdn.net/ Frame 5EA1	41 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/c0c7f8e6-44aa-4c75-aad9-e958e0bdb20e Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash d49b412dd0e70c99220ceea9efc30666ee85533b47fadd2cb0bb7a20c863f065 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 41472 Content-Type image/png
GET H3	200	copy5.png Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	29 KB 29 KB	7ms 7ms	XHR image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy5.png Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 78bbce7ec822db90fdacbfc576e8abeda680d70681107fd51f07a80b32a20afd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:05 GMT x-content-type-options nosniff age 27101 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29873 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:05 GMT
GET BLOB	200 OK	dfa34169-c93b-4810-a3b6-63ce9d2fcc6f https://s0.2mdn.net/ Frame 5EA1	29 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/dfa34169-c93b-4810-a3b6-63ce9d2fcc6f Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 78bbce7ec822db90fdacbfc576e8abeda680d70681107fd51f07a80b32a20afd Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 29873 Content-Type image/png
GET H3	200	cta.png Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	2 KB 2 KB	6ms 6ms	XHR image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/cta.png Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d61dfa7fd6d7c126ae0062380d4092e367aae5270413da5be2370e4219a26331 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:02 GMT x-content-type-options nosniff age 10064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1810 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:02 GMT
GET BLOB	200 OK	54825162-eed7-4d45-9aa9-e017821a0799 https://s0.2mdn.net/ Frame 5EA1	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/54825162-eed7-4d45-9aa9-e017821a0799 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash d61dfa7fd6d7c126ae0062380d4092e367aae5270413da5be2370e4219a26331 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 1810 Content-Type image/png
GET H3	200	url.png Show response s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	3 KB 3 KB	7ms 6ms	XHR image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/url.png Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_1.0.0_min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2151574259b2108ef505c0f0126ba3af15fc79ef8c6e72577e9ae06961237514 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:02 GMT x-content-type-options nosniff age 10064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3468 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:02 GMT
GET BLOB	200 OK	f35107ba-eb3d-4289-ac35-55de3813c507 https://s0.2mdn.net/ Frame 5EA1	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL blob:https://s0.2mdn.net/f35107ba-eb3d-4289-ac35-55de3813c507 Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 2151574259b2108ef505c0f0126ba3af15fc79ef8c6e72577e9ae06961237514 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Length 3468 Content-Type image/png
GET H3	200	logo.svg s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	1 KB 619 B	7ms 7ms	Image image/svg+xml	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/logo.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ba4b99098a12e6fcbabaca68424d9841e51649b8f072d05817fbf52823a7c8fc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:31:04 GMT content-encoding gzip x-content-type-options nosniff age 9042 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 572 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:31:04 GMT
GET H3	200	copy1.png s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	28 KB 28 KB	8ms 7ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy1.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 14d80967b29e841707f5d56183dc7b25b9ff8e5aca13cada1ab2e9d0e984a8bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:18:31 GMT x-content-type-options nosniff age 9795 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28795 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:18:31 GMT
GET H3	200	copy2.png s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	28 KB 28 KB	9ms 8ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy2.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fe949119743aba166776208bdaddee454df1c30a47439c3c4f00240b9c5ea13d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:02 GMT x-content-type-options nosniff age 27104 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29134 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:02 GMT
GET H3	200	copy3.png s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	44 KB 44 KB	10ms 8ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy3.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 42e655c6970596e9792f613ae0b00742222221a4739498093d506faf9cf1768a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:02 GMT x-content-type-options nosniff age 27104 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44675 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:02 GMT
GET H3	200	copy4.png s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	41 KB 41 KB	11ms 9ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy4.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d49b412dd0e70c99220ceea9efc30666ee85533b47fadd2cb0bb7a20c863f065 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Sun, 21 Nov 2021 23:49:24 GMT x-content-type-options nosniff age 51142 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 41472 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 22 Nov 2021 23:49:24 GMT
GET H3	200	copy5.png s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	29 KB 29 KB	11ms 10ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/copy5.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 78bbce7ec822db90fdacbfc576e8abeda680d70681107fd51f07a80b32a20afd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:05 GMT x-content-type-options nosniff age 27101 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29873 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:05 GMT
GET H3	200	cta.png s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	2 KB 2 KB	12ms 10ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/cta.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d61dfa7fd6d7c126ae0062380d4092e367aae5270413da5be2370e4219a26331 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:02 GMT x-content-type-options nosniff age 10064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1810 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:02 GMT
GET H3	200	url.png s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	3 KB 3 KB	13ms 11ms	Image image/png	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/url.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2151574259b2108ef505c0f0126ba3af15fc79ef8c6e72577e9ae06961237514 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:02 GMT x-content-type-options nosniff age 10064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3468 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:02 GMT
GET H3	200	img1.jpg s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	22 KB 22 KB	13ms 12ms	Image image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img1.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 72aa7635341b25a097f299e5d74b0df5b8249aace15daa54b311183cbe432d29 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:01 GMT x-content-type-options nosniff age 10065 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22677 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:01 GMT
GET H3	200	img2.jpg s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	21 KB 21 KB	14ms 13ms	Image image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img2.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a3872b77bbaea007012fe7e59bc7d7da8e9ffcacd5c5aba87a88c3467e957ac9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:14:02 GMT x-content-type-options nosniff age 10064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21802 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:14:02 GMT
GET H3	200	img3.jpg s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	22 KB 22 KB	14ms 13ms	Image image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img3.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bd09a5445ab1d930c5b98c384ea8d591f580afd7a650c2c1763da51cf533f6f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 11:04:20 GMT x-content-type-options nosniff age 10646 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22925 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 11:04:20 GMT
GET H3	200	img4.jpg s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	183 KB 184 KB	15ms 14ms	Image image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img4.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 98896d690f7722ffa558a934326bd000bdd2e3606670b3a355973413fd885ebd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:28:07 GMT x-content-type-options nosniff age 27219 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 187851 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:28:07 GMT
GET H3	200	img5.jpg s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/ Frame 5EA1	34 KB 34 KB	16ms 15ms	Image image/jpeg	2a00:1450:4001:801::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/img5.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5aaccdf3ef85292e38d514ea328cac34f57844b6d0401ae848bc82193fe08f17 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ads/richmedia/studio/pv2/61925094/20211018023909308/Generic_Standard_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=5yvUNzk4gM&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 22 Nov 2021 06:30:02 GMT x-content-type-options nosniff age 27104 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35076 x-xss-protection 0 last-modified Mon, 18 Oct 2021 09:39:09 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 23 Nov 2021 06:30:02 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame CE7B	42 B 64 B	43ms 43ms	Fetch image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstHm5cG5qm-Rx37qt3HxeAiboldSCcOp31Y2Zdf85_HkKFoqDP4lPNo_w1IblnMdr2KMH5tkVyRfSDCDZBYFX63TC5PBDbNQYYbZjjHXd0Uuj2SOyX1Bg&sai=AMfl-YRsqA_sr68vC1TR9kxZqHDrNdH1osk70P3FRlE66n2ujGFCDfyulojh6qYlNe71M0FiMIzvTg3JA8eP-FvxyucLX1vreN64dXrbhLTMAyeAdS86PYikbfSng7js9Eg&sig=Cg0ArKJSzKbNoJLb4A8IEAE&cid=CAASFeRo9iFoekptSkOwjKnn4HIQU2iAqQ&id=lidar2&mcvt=1001&p=5,436,99,1164&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=3846852823&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1637589704077&rpt=1206&isd=0&lsd=0&met=mue&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame CE7B	42 B 64 B	44ms 43ms	Fetch image/gif	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvuW-qqMslgQBLpEIfjkD5jwxdtx8EVXY9JccpNNgKNl1LeoO_F3_bXm9xxoVodGpTBg8uVywnHe-yQQM9iJPUSgwf9JTvz7_Y&sig=Cg0ArKJSzE8l4exYWR5mEAE&id=lidar2&mcvt=1002&p=0,0,90,728&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=32&adk=3047537733&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1637589704077&rpt=1208&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	results.txt Show response rdz4muqxedxjqym3ulfa-pdfvc5-76ceaa3e0-clientnsv4-s.akamaihd.net/eum/ Frame 1B38 Redirect Chain https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pdfvc5v74 https://rdz4muqxedxjqym3ulfa-pdfvc5-76ceaa3e0-clientnsv4-s.akamaihd.net/eum/results.txt	8 B 312 B	520ms 7ms	XHR text/plain	23.32.238.128 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://rdz4muqxedxjqym3ulfa-pdfvc5-76ceaa3e0-clientnsv4-s.akamaihd.net/eum/results.txt Protocol HTTP/1.1 Server 23.32.238.128 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-32-238-128.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:47 GMT Last-Modified Wed, 08 May 2013 07:51:12 GMT Server AkamaiNetStorage ETag "402e7a087747cb56c718bde84651f96a:1367999472" Content-Type text/plain Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 8 Redirect headers Location https://rdz4muqxedxjqym3ulfa-pdfvc5-76ceaa3e0-clientnsv4-s.akamaihd.net/eum/results.txt Date Mon, 22 Nov 2021 14:01:46 GMT Server AkamaiGHost Connection keep-alive Access-Control-Allow-Origin * Content-Length 0
GET H/1.1	200 OK	results.txt Show response fiaqj6accidy4kqce3ygyaaaabqzxiwl-pdfvc5-0d0e0f807-clienttons-s.akamaihd.net/eum/ Frame 1B38 Redirect Chain https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pdfvc5v74 https://fiaqj6accidy4kqce3ygyaaaabqzxiwl-pdfvc5-0d0e0f807-clienttons-s.akamaihd.net/eum/results.txt	8 B 312 B	61ms 6ms	XHR text/plain	2a02:26f0:6c00::210:ba13 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://fiaqj6accidy4kqce3ygyaaaabqzxiwl-pdfvc5-0d0e0f807-clienttons-s.akamaihd.net/eum/results.txt Protocol HTTP/1.1 Server 2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 22 Nov 2021 14:01:47 GMT Last-Modified Wed, 08 May 2013 07:51:12 GMT Server AkamaiNetStorage ETag "402e7a087747cb56c718bde84651f96a:1367999472" Content-Type text/plain Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 8 Redirect headers Location https://fiaqj6accidy4kqce3ygyaaaabqzxiwl-pdfvc5-0d0e0f807-clienttons-s.akamaihd.net/eum/results.txt Date Mon, 22 Nov 2021 14:01:47 GMT Server AkamaiGHost Connection keep-alive Access-Control-Allow-Origin * Content-Length 0
POST		/ 684dd325.akstat.io/	0 0
POST		/ 684dd325.akstat.io/	0 0
GET H2	200	pixel.gif px.moatads.com/ Frame 2C26	43 B 260 B	8ms 8ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=0x0&zMoatPS=top&zMoatSZPS=0x0%20%7C%20top&zMoatPTAT=article&zMoatPTATSECT=article&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=3408615744&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-NiIrBeoFGpG4fz6GF1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-EcfEEAlWe0wLgg%3D%3D&sc=1&os=1-gw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=770&qe=123&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=78&w=150&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=3&f=1&j=https%3A%2F%2Fwww.zdnet.com&lp=https%3A%2F%2Fwww.zdnet.com&t=1637589704174&de=963698074774&cu=1637589704174&m=5387&ar=b4494b788bb-clean&iw=5b2ce75&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=123&le=1&lf=249&lg=1&lh=116&gm=1&io=1&fa=1&ch=0&vv=3&vw=0%3A3%3A0&vp=0&vx=-%3A0%3A-&pe=0%3A127%3A239%3A783%3A362&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5175&cd=1271&ah=5175&am=1271&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5823350303%3A138371350639&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=0&zMoatH=0&zMoatVGUID=8bfe1ebc-537a-4bb6-88e8-be74c14df28e&zMoatSN=b&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe&zMoatDev=Desktop&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=195602&na=665871771&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://e6be68b639a499f2c8c97e1083b3a038.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:49 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:49 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=nav&zMoatvguid=-&zMoatptype=-&zMoatsl=nav-ad-plus-leader%3FT-1000&g=4&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=436&gp=5&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=371634088549&cu=1637589703774&m=5895&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=5&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=5049&an=1196&gi=1&gf=5049&gg=1196&ix=5049&ic=5049&ez=1&ck=1196&kw=962&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5049&bx=1196&ci=1196&jz=962&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4860&cd=962&ah=4860&am=962&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=5&jm=-1&tc=0&fs=195794&na=1987266571&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:49 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:49 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=middle&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-middle%3FLL%7CT-1000&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=250&w=300&rm=1&fy=1050&gp=1499.671875&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=112648038764&cu=1637589703774&m=6098&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1499.671875&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5035&cd=57&ah=5035&am=57&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&jk=3&jm=-1&tc=0&fs=195794&na=839708478&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:49 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:49 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=top&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-plus-top%3FLL%7CT-1000&g=4&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=600&w=300&rm=1&fy=1050&gp=421.796875&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=974567281937&cu=1637589703774&m=6300&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=421.796875&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=5190&an=1153&gi=1&gf=5190&gg=1153&ix=5190&ic=5190&ez=1&ck=1153&kw=950&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5190&bx=1153&ci=1153&jz=950&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5005&cd=950&ah=5005&am=950&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=5&jm=-1&tc=0&fs=195794&na=7795987&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:50 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=top&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-plus-top%3FLL%7CT-1000&g=5&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=600&w=300&rm=1&fy=1050&gp=421.796875&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=974567281937&cu=1637589703774&m=6502&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=421.796875&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=1&ag=5393&an=5190&gi=1&gf=5393&gg=5190&ix=5393&ic=5393&ez=1&ck=1153&kw=950&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5393&bx=5190&ci=1153&jz=950&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5207&cd=5005&ah=5207&am=5005&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&jk=5&jm=-1&tc=0&fs=195794&na=416787357&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:50 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	184.30.25.161 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24MRH%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-zbwar1teFl9Se52VHlqRTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-6sfEEAlWekwLgg%3D%3D&sc=1&os=1-4Q%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&pcode=redventuresgamheader644747280705&rx=743599421766&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=bottom&zMoatvguid=-&zMoatptype=-&zMoatsl=mpu-bottom%3FLL%7CT-1000&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=250&w=300&rm=1&fy=1050&gp=2069.640625&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-banking-trojan-sharkbot-makes-waves-across-europe%2F&id=1&ii=4&f=0&j=&t=1637589703774&de=997648044137&cu=1637589703774&m=6503&ar=7e5b6a28623-clean&iw=a0d9f77&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=2069.640625&lb=3101&le=1&lf=169&lg=1&lh=46&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A686%3A686%3A693%3A635&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5173&cd=13&ah=5173&am=13&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&jk=3&jm=-1&tc=0&fs=195794&na=1259222789&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.30.25.161 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-30-25-161.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/new-banking-trojan-sharkbot-makes-waves-across-europe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Mon, 22 Nov 2021 14:01:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 22 Nov 2021 14:01:50 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

684dd325.akstat.io

URL

https://684dd325.akstat.io/

Domain

684dd325.akstat.io

URL

https://684dd325.akstat.io/